Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

hawki · Nov 20, 2020

"Russian hacker group REvil claims massive attack on televangelist Kenneth Copeland...and threatens to release 1.2 terrabytes of 'sensitive' data if he refuses to pay their ransom

REvil on Wednesday claimed it had attacked Kenneth Copeland Ministries

Hacker group demanded unspecified ransom for return of ministry's data

Copeland is a prominent televangelist with a net worth of at least $300 million..."

https://www.dailymail.co.uk/news/ar...ve-attack-televangelist-Kenneth-Copeland.html

guest · Nov 20, 2020

FBI warns of increasing Ragnar Locker ransomware activity
November 20, 2020
https://www.bleepingcomputer.com/ne...increasing-ragnar-locker-ransomware-activity/

The U.S. Federal Bureau of Investigation (FBI) Cyber Division has warned private industry partners of increased Ragnar Locker ransomware activity following a confirmed attack from April 2020.

The MU-000140-MW flash alert issued to partners by the FBI yesterday was coordinated with DHS-CISA and it provides security professionals and system admins with indicators of compromise to guard against the persistent malicious actions of this ransomware gang.

"The FBI first observed Ragnar Locker1ransomwarein April 2020, when unknown actors used it to encrypt a large corporation’s files for an approximately $11 million ransom and threatened to release 10 TB of sensitive company data," the FBI says in the TLP:WHITE flash alert.
"Since then, Ragnar Locker has been deployed against an increasing list of victims, including cloud service providers, communication, construction, travel, and enterprise software companies."
Click to expand...

guest · Nov 25, 2020

Hackers threaten to publish data from attack on legal services firm
November 24, 2020
https://www.afr.com/companies/profe...firm-hit-by-ransomware-attack-20201124-p56hht

Legal services firm Law In Order has been hit by a ransomware attack, with hackers claiming to have stolen data and threatening to publish it if the company fails to pay up within seven days.

Law In Order is a major supplier of e-litigation services and counts among its clients law firms including King & Wood Mallesons, Allens and Gadens, as well as several royal commissions.
The company is the latest in a string of high-profile ransomware victims, with logistics company Toll Holdings, beverage giant Lion and Downer-owned facilities management company Spotless also hit this year.
Click to expand...

Hacking group NetWalker claimed responsibility for the attack on Tuesday and published what it claimed were screenshots of folders from Law In Order's internal system on its dark web blog.
NetWalker also published extracts from Law In Order's website, including that the company had "rigorous protocols" and "iron-clad security".

"It's no wonder so many top-tier law firms, blue-chip companies and government agencies trust us with their highly sensitive and confidential information," an extract from the company's About Us page read.
Click to expand...

Law In Order did not respond to questions about whether the company was considering paying a ransom.
Click to expand...

guest · Nov 28, 2020

IIoT chip maker Advantech hit by ransomware, $12.5 million ransom
November 28, 2020
https://www.bleepingcomputer.com/ne...vantech-hit-by-ransomware-125-million-ransom/

The Conti ransomware gang hit the systems of industrial automation and Industrial IoT (IIoT) chip maker Advantech and is now demanding a $14 million ransom to decrypt affected systems and to stop leaking stolen company data.

Advantech is a global leading manufacturer of IT products and solutions, including embedded PCs, network devices, IoT, servers, and healthcare solutions, with a workforce of over 8,000 people in 92 major cities around the world.
Ransom set at 750 Bitcoins
The Conti operators behind the attack on Advantech's network have set a ransom of 750 BTC (roughly $12,600,000 at today's exchange rate) for full data decryption and for removing stolen data from their servers according to a chat log seen by BleepingComputer.
Click to expand...

The ransomware operators added on November 21, 2020, that they will leak part of the stolen data if there was no reply from the company within the next day.
On November 26, the group began publishing Advantech's data on their ransomware data leak site as a 3.03GB archive with 2% of the stolen data and a text document with a list of files included in the ZIP archive.

The ransomware gang also stated that if the ransom is paid they will immediately remove any backdoors deployed on the company's network and will provide security tips on how to secure the network to block future breaches.
Click to expand...

guest · Nov 30, 2020

mood said: ↑

IIoT chip maker Advantech hit by ransomware, $12.5 million ransom November 28, 2020
Click to expand...

Update (November 30, 2020):

11/30/20 Update below. This post was originally published on November 28th, 2020. It has been updated to reflect Advantech's confirmation of the attack.

An Advantech spokesperson confirmed the ransomware attack and that data was stolen from the company's systems but did not comment on Conti's ransom demands.

Advantech, a global leader in industrial IoT, has implemented countermeasures against the recent malicious cyberattacks. We have activated and updated our information security and protection mechanisms, and our current status is detailed below:
[...]
While resolving this incident, Advantech has introduced new detection, protection, and response actions into our cyber security strategies to mitigate risks of future attacks. We hope that our global colleagues, partners, and customers remain patient throughout the recovery period as we overcome this major cyberattack setback.
Click to expand...

guest · Dec 4, 2020

Metro Vancouver’s transit system hit by ransomware attack
December 3, 2020
https://globalnews.ca/news/7499986/translink-suspicious-network-activity-update/

Metro Vancouver’s transit system is the latest victim of a ransomware attack.

Global News has obtained the ransom letter sent to TransLink amid “suspicious network activity” this week that has caused several major problems across the transit system.
TransLink CEO Kevin Desmond confirmed the attack in a media release late Thursday.

“Your network has been ATTACKED, your computers and servers were LOCKED, your private data was DOWNLOADED,” reads the letter.
“If you do not contact us in the next three DAYS we will begin DATA publication.”
Click to expand...

The letter viewed by Global News does not specify a ransom amount, but goes on to claim that recovering the data and systems without paying the ransom will cost “hundreds of millions” of dollars.
The transit agency is taking the position that it will not give in to the ransom demand, sources tell Global News.
Click to expand...

Here is a portion of the ransom letter sent to @TransLink. I’ll have more on @GlobalBC #NewsHour at 6. pic.twitter.com/bklnMR4TY2
— Jordan Armstrong (@jarmstrongbc) December 3, 2020
Click to expand...

guest · Dec 4, 2020

Largest global staffing agency Randstad hit by Egregor ransomware
December 4, 2020
https://www.bleepingcomputer.com/ne...ng-agency-randstad-hit-by-egregor-ransomware/

Staffing agency Randstad NV announced today that their network was breached by the Egregor ransomware, who stole unencrypted files during the attack.

This week, the Egregor ransomware operation published what they claim is 1% of Randstad's data stolen during a recent cyberattack. This leaked data is a 32.7MB archive containing 184 files, including accounting spreadsheets, financial reports, legal documents, and other miscellaneous business documents.
After the threat actors published their data, Randstad issued a security notification confirming that the Egregor ransomware operation attacked them.
Click to expand...

The company confirmed that data was stolen but is still investigating whether the personal data of clients of employees was accessed. At this time, they believe that only data related to their operations in the US, Poland, Italy, and France was stolen.

"To date, our investigation has revealed that the Egregor group obtained unauthorized and unlawful access to our global IT environment and to certain data, in particular related to our operations in the US, Poland, Italy and France," Randstad disclosed.
Click to expand...

The Egregor ransomware operation has been extremely active over the past week, with successful attacks against Metro Vancouver's transit system TransLink and the big-box department store Kmart.
Click to expand...

guest · Dec 5, 2020

Ransomware hits helicopter maker Kopter
December 5, 2020
https://www.zdnet.com/article/ransomware-hits-helicopter-maker-kopter/

Helicopter maker Kopter has fallen victim to a ransomware attack after hackers breached its internal network and encrypted the company's files.

After Kopter refused to engage with the hackers, the ransomware gang has published on Friday some of the company's files on the internet.
LOCKBIT RANSOMWARE GANG TAKES CREDIT
The Kopter data has been published on a blog hosted on the dark web and operated by the LockBit ransomware gang. Files shared on this site include business documents, internal projects, and various aerospace and defense industry standards.
Click to expand...

In an email, the operators of the LockBit ransomware told ZDNet that they breached Kopter's network last week by exploiting a VPN appliance that used a weak password and did not have two-factor authentication (2FA) enabled.
The LockBit gang also said they operate a web portal on the dark web where they show details to hacked companies about the attack, including a ransom demand.
Click to expand...

guest · Dec 5, 2020

Windows ransomware used to hit aircraft leasing asset manager
December 5, 2020
https://www.itwire.com/security/windows-ransomware-used-to-hit-aircraft-leasing-asset-manager.html

Premier aircraft leasing asset manager SKY Leasing has been hit by a gang of cyber criminals using the Windows Avaddon ransomware and the attackers have leaked 20 files of the company's data on the dark web.

iTWire contacted the company on 30 November, using the only email address available on the company's website, and seeking comment by 10am AEDT on 2 December. There has been no response to date, apart from an automated reply which shows the email has reached its intended address.
Most of the information that has been dumped appears to be financial data, with some information relating to leases and others being about technical pre-buy inspections.
Click to expand...

The Avaddon ransomware behaves as does other malware of its genre, encrypting data after having first exfiltrated it so that the attackers in question have an additional means of putting pressure on victims to pay up.
Click to expand...

guest · Dec 6, 2020

Embraer suffers hacker attack and says it does not know the extent of the damage
December 1, 2020
https://www.time24.news/2020/12/emb...t-does-not-know-the-extent-of-the-damage.html

Embraer reported on Monday night that it suffered an attack hacker last week, which would have resulted “in the disclosure of data allegedly attributed to the company in the early hours of November 30”, according to a relevant fact.

GLOBO learned that it was a ransomware, a type of attack that restricts access to systems and demands a ransom from those who have been invaded.
According to the company, the attack was identified on November 25. The hackers they would have had access, according to Embraer, to “just a company archive environment”. The aircraft manufacturer did not reveal, however, what kind of information was leaked.
Click to expand...

Sources also reported that Embraer has not yet restored all of its systems and that the attack affected access, at least momentarily, for all employees who worked in the home office.
Click to expand...

guest · Dec 6, 2020

mood said: ↑

Embraer suffers hacker attack and says it does not know the extent of the damage December 1, 2020
Click to expand...

Hackers leak data from Embraer, world's third-largest airplane maker
The Brazilian company was the victim of a ransomware attack last month, in November
December 7, 2020
https://www.zdnet.com/article/hackers-leak-data-from-embraer-worlds-third-largest-airplane-maker/

Brazilian company Embraer, considered today's third-largest airplane maker after Boeing and Airbus, was the victim of a ransomware attack last month.

Today, hackers involved in the intrusion have leaked some of the company's private files as revenge after the airplane maker refused to negotiate and instead chose to restore systems from backups without paying their ransom demand.
The Embraer files were shared on a website hosted on the dark web, managed by the RansomExx (also known as Defray777) ransomware gang.

Data uploaded on this site included samples of employee details, business contracts, photos of flight simulations, and source code, among others, according to samples reviewed by ZDNet.
Click to expand...

Today's leak confirms that hackers managed to steal data from the company's servers. Embraer issued a press release last week, admitting to a security breach, but did not confirm that the incident involved neither ransomware nor data theft.
RANSOMEXX GETS A "LEAK SITE"
Embraer is also one of three companies that had their data leaked over the weekend on the RansomExx leak site, launched on Saturday.

The RansomExx gang now joins a long list of ransomware gangs that run leak sites.
Click to expand...

guest · Dec 7, 2020

Foxconn electronics giant hit by ransomware, $34 million ransom
December 7, 2020
https://www.bleepingcomputer.com/ne...cs-giant-hit-by-ransomware-34-million-ransom/

Foxconn electronics giant suffered a ransomware attack at a Mexican facility over the Thanksgiving weekend, where attackers stole unencrypted files before encrypting devices.

Foxconn is the largest electronics manufacturing company globally, with recorded revenue of $172 billion in 2019 and over 800,000 employees worldwide. Foxconn subsidiaries include Sharp Corporation, Innolux, FIH Mobile, and Belkin.
Click to expand...

Today, the DoppelPaymer ransomware published files belonging to Foxconn NA on their ransomware data leak site. The leaked data includes generic business documents and reports but does not contain any financial information or employee's personal details.

Since the attack, the facility's web site has been down and currently shows an error to visitors.
Attackers demand $34 million ransom
Sources have also shared the ransom note created on Foxconn servers during the ransomware attack, as can be seen below.
Click to expand...

guest · Dec 8, 2020

mood said: ↑

Foxconn electronics giant hit by ransomware, $34 million ransom December 7, 2020
Click to expand...

Update (December 8, 2020):

In a statement to BleepingComputer, Foxconn confirmed the attack and said they are slowly bringing their systems back into service.

"We can confirm that an information system in the US that supports some of our operations in the Americas was the focus of a cybersecurity attack on November 29. We are working with technical experts and law enforcement agencies to carry out an investigation to determine the full impact of this illegal action and to identify those responsible and bring them to justice."
"The system that was affected by this incident is being thoroughly inspected and being brought back into service in phases," Foxconn told BleepingComputer.
Update 12/8/20: Added statement from Foxconn.
Click to expand...

guest · Dec 10, 2020

85,000 MySQL Servers Hit in Active Ransomware Campaign
Attackers pressure victims into paying ransom by publishing and offering for sale data stolen in a campaign that dates back to January
December 10, 2020
https://www.darkreading.com/threat-...-in-active-ransomware-campaign/d/d-id/1339673

An active ransomware campaign targeting MySQL database servers is pressuring victims into paying ransom by posting and selling stolen information on the Dark Web, researchers report.

The campaign, which Guardicore Labs calls "Please_Read_Me," started as early as January 2020. At least 85,000 servers have been breached so far. Since multiple databases are usually stolen from a single victim, the attackers have 250,000 databases offered for sale in their dashboards.
The first attack was detected on Jan. 24; since then, a total of 92 attacks have been reported by Guardicore's sensors. Attacks originate from 11 different IP addresses, most of which are from Ireland and the United Kingdom.
Click to expand...

Attackers stepped up their game for the second phase, which started on Oct. 3 and lasted through the end of November.
The attackers launched a website on Tor where victims could pay and where they also leaked databases belonging to victims who didn't pay. This site lists the 250,000 databases, which hold 7TB of stolen information.
Click to expand...

Guardicore: PLEASE_READ_ME: The Opportunistic Ransomware Devastating MySQL Servers

PLEASE_READ_ME is an active ransomware campaign targeting MySQL database servers and dates back to at least as early as January 2020.

The attackers leave a backdoor user on the database for persistence, allowing them to re-access the network.
Guardicore Labs have witnessed two variants of the campaign, detailed in this post.

Monetization of the campaign has evolved into a double extortion attempt – publishing and offering data for sale to pressure victims into paying ransom.

Click to expand...

guest · Dec 10, 2020

Payment Processing Giant TSYS: Ransomware Incident “Immaterial” to Company
December 10, 2020
https://krebsonsecurity.com/2020/12...ys-ransomware-incident-immaterial-to-company/

Payment card processing giant TSYS suffered a ransomware attack earlier this month. Since then reams of data stolen from the company have been posted online, with the attackers promising to publish more in the coming days. But the company says the malware did not jeopardize card data, and that the incident was limited to administrative areas of its business.

Headquartered in Columbus, Ga., Total System Services Inc. (TSYS) is the third-largest third-party payment processor for financial institutions in North America, and a major processor in Europe.
Click to expand...

On December 8, the cybercriminal gang responsible for deploying the Conti ransomware strain (also known as “Ryuk“) published more than 10 gigabytes of data that it claimed to have removed from TSYS’s networks.
Conti is one of several cybercriminal groups that maintains a blog which publishes data stolen from victims in a bid to force the negotiation of ransom payments.

In a written response to requests for comment, TSYS said the attack did not affect systems that handle payment card processing.

“We experienced a ransomware attack involving systems that support certain corporate back office functions of a legacy TSYS merchant business,” TSYS said. “We immediately contained the suspicious activity and the business is operating normally.”
Click to expand...

TSYS declined to say whether it paid any ransom.
Click to expand...

guest · Dec 13, 2020

Intel's Habana Labs hacked by Pay2Key ransomware, data stolen
December 13, 2020
https://www.bleepingcomputer.com/ne...abs-hacked-by-pay2key-ransomware-data-stolen/

Intel-owned AI processor developer Habana Labs has suffered a cyberattack where data was stolen and leaked by threat actors.
Habana Labs is an Israeli developer of AI processors that accelerate artificial intelligence workloads in the datacenter. Intel purchased the company in December 2019 for approximately $2 billion.

Today, the Pay2Key ransomware operation leaked data allegedly stolen from Habana Labs during a cyberattack. This data includes Windows domain account information, DNS zone information for the domain, and a file listing from its Gerrit development code review system.
In addition to the content posted on their data leak site, the Pay2Key operators have leaked business documents and source code images.
Click to expand...

Profero believes Iranian threat actors are behind the ransomware operation after tracking the group's ransom payment wallets to Iranian bitcoin exchanges.

Over the past week, threat actors hacked Israeli shipping and cargo software company Amital and used their access to breach forty of the software company's clients in a supply chain attack.
While performing incident response, Profero and Israeli cybersecurity firm Security Joes have linked IOCs from these attacks to those discovered in previous Pay2Key attacks.
Click to expand...

guest · Dec 16, 2020

440GB of data from US-based temporary staffing agency leaked on hacker forum
December 14, 2020
https://cybernews.com/security/440g...orary-staffing-agency-leaked-on-hacker-forum/

A 440GB archive that purportedly belongs to Automation Personnel Services, a US-based temporary employment agency, has been leaked on a popular hacker forum. Automation Personnel Services says the post-breach investigation “is currently ongoing and the scope and nature of the data impacted is not yet confirmed.”
Click to expand...

According to the forum post, the archive includes confidential company data and sensitive documents related to Automation Personnel Services users, partners, and employees, such as accounting and payroll data, as well as various legal documents.

The archive was leaked on November 24. It appears to have been made public as a consequence of a failed negotiation with cybercriminals, after Automation Personnel Services apparently refused to pay the ransom.

“The data is preloaded and will be automatically published if you do not pay.”
- Ransomware message seen in the forum post
Click to expand...

What data has been leaked?
The leaked data appears to come from Automation Personnel Services, which lists itself as “one of the leading temporary staffing agencies” in America, with more than 30 locations across the US. Established in 1990, the company offers its services to employers and job seekers from the manufacturing, technical, automotive, and other industries.

Based on the samples we saw from the leaked archive, it appears to contain confidential company data from the past four years (2017-2020) [...]
Who had access to the data?
Since the data was made freely available in the final week of November, it’s safe to assume that multiple users of the hacker forum where it was posted had access to the data.
Click to expand...

guest · Dec 20, 2020

Flavors designer Symrise halts production after Clop ransomware attack
December 20, 2020
https://www.bleepingcomputer.com/ne...alts-production-after-clop-ransomware-attack/

Flavor and fragrance developer Symrise has suffered a Clop ransomware attack where the attackers allegedly stole 500 GB of unencrypted files and encrypted close to 1,000 devices.

Symrise is a major developer of flavors and fragrances used in over 30,000 products worldwide, including those from Nestle, Coca-Cola, and Unilever. Symrise generated €3.4 billion in revenue for 2019 and employs over 10,000 people.
Last week, German media reported that Symrise suffered a cyberattack that forced them to shut down their systems to prevent the spread of the attack.

"In order to be able to assess the consequences and to prevent possible further effects, the company shut down all essential systems," Symrise told Handelsblatt.
Click to expand...

Attacked by the Clop ransomware gang
The Clop ransomware gang has claimed responsibility for the attack on Symrise and have told BleepingComputer that they allegedly encrypted 1,000 devices.
As proof of this theft, Clop has posted images of these allegedly stolen files on their data leak site. The leaked images are for passports, accounting documents, audit reports, confidential cosmetic ingredients, and emails.

BleepingComputer reached out to Symrise last week with questions regarding this attack but did not receive a response.
Click to expand...

guest · Dec 21, 2020

mood said: ↑

Payment Processing Giant TSYS: Ransomware Incident “Immaterial” to Company
December 10, 2020
https://krebsonsecurity.com/2020/12...ys-ransomware-incident-immaterial-to-company/
Click to expand...

TSYS staff in Belfast and Derry told personal data at risk after ransomware attack
December 22, 2020
https://www.irishnews.com/business/...data-at-risk-after-ransomware-attack-2167478/

STAFF at payments solutions company TSYS in Belfast and Derry have been told their personal data has likely been compromised after the US-owned fintech group was targeted in a ransomware attack.

TSYS informed its Northern Ireland staff on Wednesday that a ransomware attack had deleted or encrypted certain files on its systems.
But it said the incident had likely compromised the personal data of its staff in both Belfast and Derry.

TSYS said the data may include names, addresses, national insurance numbers and payroll information. But it could also include bank details.
Click to expand...

The group said it is not yet aware of any harm caused as a result of the breach, but said the attackers had made some of the data available on the internet and threatened to disclose more.
Click to expand...

guest · Dec 22, 2020

Report: Hacker attack on Funke media group
December 22, 2020
https://www.de24.news/en/2020/12/report-hacker-attack-on-funke-media-group.html

After a hacker attack, the newspapers of the Funke media group only appear with an “emergency issue” on Wednesday. This was confirmed by the digital editor-in-chief of the Zentralredaktion, Carsten Erdmann, on Twitter after the “MDR Thuringia” first reported about it on Tuesday afternoon.

Meanwhile, the “Thüringer Allgemeine”, a newspaper of the Funke media group, has published its own article on the incident. The Essen police have therefore started the investigation, as they confirmed at the request of the German press agency.
Click to expand...

Paywall deactivated, EPaper free
When asked by t-online, a press officer from the Funke media group said: “So that all of our readers remain well informed, we have deactivated our paywalls and released our epaper. We will inform you as soon as we have further news.”
Click to expand...

According to research by the “Süddeutsche Zeitung”, the cybercrime gang behind the ransomware Doppelpaymer could be responsible for the attack.

According to the “Süddeutsche Zeitung”, the attackers are demanding a ransom in Bitcoin from the Funke media group in order to release the encrypted data. The company now has three days to pay the requested amount.
Click to expand...

guest · Dec 24, 2020

FreePBX developer Sangoma hit with Conti ransomware attack
December 24, 2020
https://www.bleepingcomputer.com/ne...per-sangoma-hit-with-conti-ransomware-attack/

Sangoma disclosed a data breach after files were stolen during a recent Conti ransomware attack and published online.
Sangoma is a voice over IP hardware and software provider known for the popular open-source FreePBX PBX phone system that allows organizations to create cheap corporate phone system on their network.

Yesterday, the Conti ransomware gang published over 26 GB of data on their ransomware data leak site that was stolen from Sangoma during the recent cyberattack. This leaked data includes files related to the company's accounting, financials, acquisitions, employee benefits and salary, and legal documents.
Click to expand...

Today, Sangoma confirmed that the ransomware attack resulted in a data breach after private and confidential for their company and employees were published online.

"Sangoma Technologies Corporation (TSXV: STC) (the “Company” or “Sangoma”) announced that, as a result of a ransomware cyber attack on one of the Company’s servers, private and confidential data belonging to the Company was posted online yesterday," Sangoma disclosed in an advisory.
Click to expand...

guest · Dec 24, 2020

Hackers threaten to post 'before and after' pictures of cosmetic surgery patients
December 24, 2020
https://www.telegraph.co.uk/news/20...aten-post-pictures-cosmetic-surgery-patients/

Hackers are threatening to publish ‘before and after’ pictures of patients who have had surgery after vast amounts of data were stolen from a major cosmetic surgery chain, it has emerged.

The Transform Hospital Group suffered a ransomware attack and has reported the incident to the Information Commission.
The company, which has had numerous celebrity endorsements, has also written emails to its customers warning of the “data security incident”.
Click to expand...

A hacker group known as REvil boasted on the darknet webpage of how it had obtained more than 900 gigabytes of patient photographs. The group said the “intimate photos of customers” were “not a completely pleasant sight”.

“We have secured our systems and a full investigation is underway to understand the extent of the incident. We are working with the National Cyber Security Centre, Information Commissioner’s Office, cyber security experts and the police to resolve the situation as quickly as possible.”
Click to expand...

The company has previously promoted itself via celebrity endorsements, although in recent years it has not done so.
"I'm obviously concerned as the last thing I want is 'before photos' being splattered around in the public domain. I've tried to keep my surgery private and not even some of my friends and colleagues know about it, so the data breach is concerning for me."
Click to expand...

guest · Dec 27, 2020

mood said: ↑

Italian beverage vendor Campari knocked offline after ransomware attack
Campari has refused to engage with the ransomware gang and is restoring systems
November 5, 2020
https://www.zdnet.com/article/itali...pari-knocked-offline-after-ransomware-attack/
Click to expand...

Campari Data Breach Slows Local Operations
December 27, 2020
http://jamaica-gleaner.com/article/business/20201227/campari-data-breach-slows-local-operations

Rum maker J. Wray & Nephew (JWN) is reporting that while it was forced to revert to some manual procedures following a global malware breach affecting group operations at its Italian parent Campari, business continuity procedures were activated to keep business functions intact.

“The hack did not negatively affect sales. If anything, it resulted in the team working longer,” JWN spokesperson Tanikie McClarthy Allen said this week.
The hack of one of the largest global spirits makers and distributors comes at a time when other databases around the world are being attacked with increased frequency as staff work remotely, which extends the boundary of corporate networks, making them more susceptible to attacks.
Click to expand...

Across the global Campari network, some peripheral or secondary services remain temporarily suspended; some deliberately for security reasons. Taking those network services offline has reduced functionality, the group reported earlier this month.

“As there is an ongoing investigation in place, it is possible that new facts may come to light going forward,” a statement by Campari said.
Click to expand...

stapp · Dec 28, 2020

Home appliance giant Whirlpool hit in Nefilim ransomware attack

Home appliances giant Whirlpool suffered a ransomware attack by the Nefilim ransomware gang who stole data before encrypting devices.

Whirlpool is one of the world's largest home application makers with appliances under its name and KitchenAid, Maytag, Brastemp, Consul, Hotpoint, Indesit, and Bauknecht. Whirlpool employs 77,000 people at 59 manufacturing & technology research centers worldwide and generated approximately $20 billion in revenue for 2019.
Click to expand...

https://www.bleepingcomputer.com/ne...t-whirlpool-hit-in-nefilim-ransomware-attack/

guest · Dec 30, 2020

Hackers publish client data stripped from Auckland financial services company on dark web
December 30, 2020
https://www.stuff.co.nz/business/in...ckland-financial-services-company-on-dark-web

Personal information belonging to clients of an Auckland financial services firm has been published on the dark web after the company fell victim to a ransomware attack.

Earlier this month a blog post on the dark web showed cyberattackers appeared to be in possession of sensitive information held by financial services company Staircase Financial Management.
The post on NetWalker Blog had a countdown clock indicating how much time was left before the data was made public. That clock has now run out and the data has been made public across multiple third party file sharing sites.
Click to expand...

In a written statement Staircase director Kylie Turgis said its clients had been advised of the cyber-attack.
It had also consulted with Government agency Cert NZ and the office of the Privacy Commissioner, and was following their recommendations, she said.
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

stapp Global Moderator

guest Guest

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

stapp Global Moderator

guest Guest

Useful Searches