Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest · Nov 22, 2022

mood said: ↑

New 'Donut Leaks' extortion gang linked to recent ransomware attacks
August 23, 2022
Click to expand...

Donut extortion group also targets victims with ransomware
By Lawrence Abrams @LawrenceAbrams - November 22, 2022

The Donut (D0nut) extortion group has been confirmed to deploy ransomware in double-extortion attacks on the enterprise.

BleepingComputer first reported on the Donut extortion group in August, linking them to attacks on Greek natural gas company DESFA, UK architectural firm Sheppard Robson, and multinational construction company Sando.
Unit 42 researcher Doel Santos also shared that the TOX ID used in ransom notes was seen in samples of the HelloXD ransomware.
Click to expand...

This cross-posting of stolen data and affiliation leads us to believe the threat actor behind Donut Leaks is an affiliate for numerous operations, now trying to monetize the data in their own operation.
The Donut ransomware
This week, BleepingComputer found a sample [VirusTotal] of an encryptor for the Donut operation, aka D0nut, showing that the group is using its own customized ransomware for double-extortion attacks.

The Donut Leaks operation has a flair for theatrics, using interesting graphics, a bit of humor, and even offering a builder for an executable that acts as a gateway to their Tor data leak site (see below).
Click to expand...

guest · Nov 23, 2022

Yanluowang Ransomware's Russian Links Laid Bare
Phil Muncaster UK / EMEA News Reporter, Infosecurity Magazine - November 23, 2022

The inner workings of yet another ransomware group have been laid bare after internal messages were leaked online, suggesting the Yanluowang group was actually run by Russian speakers.
Click to expand...

Threat intelligence firm Trellix analyzed close to 3000 messages shared by Twitter user @yanluowangleaks, revealing some interesting tidbits.

The group, which was responsible for breaching big-name organizations over the past year including Walmart and Cisco, converses in Russian, despite its Chinese mythological moniker.
In fact, at one point it wanted to post a message in support of Ukraine on its ransom page to increase the chances of payment, but decided not to out of concerns it would blow the Chinese cover story, Trellix said.
Click to expand...

There are also ties to the Babuk gang which quit the ransomware game last year.

“It seems that before Yanluowang developed their own Linux/Unix ransomware locker, they used a Linux locker from Babuk ransomware gang,” Trellix explained.
“In a conversation between Saint and Guki, Saint implies that Babuk died because of the hacker Wazawaka’s (aka Boriselcin) return, and that Saint himself lost a couple of millions dollars due to Babuk locker not decrypting the files as it should.”
Click to expand...

Trellix: Yanluowang Ransomware Leaks Analysis: Organization, Collaboration with HelloKitty, Babuk and Conti

By Jambul Tologonov @j_tologon - November 22, 2022
On October 31, 2022, Yanluowang’s TOR site was hacked displaying a message “check and mate!! Yanluowang Matrix chat hacked @yanluowangleaks Time’s up!! :) you screwed!! Time’s up!”:
On the same day a Twitter handle @yanluowangleaks shared dumps of Yanluowang’s Matrix chat messages. We immediately downloaded the internal chat logs and began our investigation.

[...] we have gained a valuable intel on Yanluowang threat actor, their innerworkings, victims and possible collaboration with other Russian ransomware groups. Further details are provided in the below sections.
Click to expand...

guest · Nov 24, 2022

New RansomExx Ransomware Variant Rewritten in the Rust Programming Language
By Ravie Lakshmanan - November 24, 2022

The operators of the RansomExx ransomware have become the latest to develop a new variant fully rewritten in the Rust programming language, following other strains like BlackCat, Hive, and Luna.
Click to expand...

The latest version, dubbed RansomExx2 by the threat actor known as Hive0091 (aka DefrayX), is primarily designed to run on the Linux operating system, although it's expected that a Windows version will be released in the future.

"Malware written in Rust often benefits from lower [antivirus] detection rates (compared to those written in more common languages) and this may have been the primary reason to use the language," IBM Security X-Force researcher Charlotte Hammond said in a report published this week.

"RansomExx is yet another major ransomware family to switch to Rust in 2022," Hammond explained.
"While these latest changes by RansomExx may not represent a significant upgrade in functionality, the switch to Rust suggests a continued focus on the development and innovation of the ransomware by the group, and continued attempts to evade detection."
Click to expand...

IBM X-Force: RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, growing trend of ransomware developers switching to the language.
Click to expand...

guest · Nov 26, 2022

Ransomware gang targets Belgian municipality, hits police instead
By Bill Toulas @billtoulas - November 26, 2022

The Ragnar Locker ransomware gang has published stolen data from what they thought was the municipality of Zwijndrecht, but turned out to be stolen from Zwijndrecht police, a local police unit in Antwerp, Belgium.

The leaked data reportedly exposed thousands of car number plates, fines, crime report files, personnel details, investigation reports, and more.
This type of data can potentially expose people who reported crimes or abuse and could compromise ongoing law enforcement operations and investigations.
Click to expand...

Belgian media outlets call this data leak one of the biggest of this kind that has impacted a public service in the country, exposing all data kept by Zwijndrecht police from 2006 until September 2022.
Police confirm attack
Chief of police at Zwijndrecht, Marc Snels, told the VRT news network that the data leak resulted from human error, and they are now contacting all exposed individuals to inform them about the incident.

"It is not the case that all data has been leaked. This network mainly contains personal information from our staff, such as personnel lists and photos from personnel parties," commented Snels to local media.
Click to expand...

Wider impact than claimed
Although this incident has not impacted the national police network in Belgium, the breach on the local Zwijndrecht network is still significant for thousands of people.

Belgian journalist Kenneth Dée broke the news of the attack on Het Laatste Nieuws, sharing that the threat actors allegedly attacked a poorly protected Citrix endpoint to breach the police's network.
Moreover, the leaked files contain footage from traffic cameras, exposing the whereabouts of individuals at specific dates and times.

"This is the largest law-enforcement leak in the history of Belgium and probably the most impactful leak we have ever seen in our country," Dée told Bleeping Computer.
Click to expand...

guest · Dec 13, 2022

LockBit claims attack on California's Department of Finance
By Ionut Ilascu @Ionut_Ilascu - December 13, 2022

The Department of Finance in California has been the target of a cyberattack now claimed by the LockBit ransomware gang.
Click to expand...

An investigation has been started by the California Cybersecurity Integration Center (Cal-CSIC), a group of state and federal agencies dedicated to protecting against cyber threats.
Ongoing investigation
California Governor’s Office of Emergency Services has confirmed that the Department of Finance has been affected by a cyber incident but did not provide too many details.

“The intrusion was proactively identified through coordination with state and federal security partners. Upon identification of this threat, digital security and online threat-hunting experts were rapidly deployed to assess the extent of the intrusion and to evaluate, contain and mitigate future vulnerabilities” - California’s Office of Emergency Services
Click to expand...

LockBit claims 75GB of stolen files
On Monday, the LockBit ransomware gang posted on their leak site that they had breached the Department of Finance of the state of California and stole databases, confidential data, financial documents, and IT documents.
To prove their claim, the hackers published a few screenshots of files they allegedly exfiltrated from the systems of the Department of Finance in California.

LockBit’s data leak site shows a counter to get paid by December 24, threatening to publish all the files unless they get their ransom.
Click to expand...

guest · Dec 14, 2022

Play ransomware claims attack on Belgium city of Antwerp
By Lawrence Abrams @LawrenceAbrams - December 12, 2022

The Play ransomware operation has claimed responsibility for a recent cyberattack on the Belgium city of Antwerp.
Click to expand...

Last week, Digipolis, the IT company responsible for managing Antwerp's IT systems, suffered a ransomware attack that disrupted the city's IT, email, and phone services.

Local media reported that many of the city's Windows applications were no longer available, and City council member Alexandra d'Archambeau publicly tweeted that email was not available.
Click to expand...

Play ransomware claims attack
This Antwerp entry on the data leak site claims that 557 GB of data was stolen during the attack, including personal information, passports, IDs, and financial documents.
However, data from the city has yet to be leaked, with the threat actors indicating they will begin publishing data in a week unless a ransom is paid.
Click to expand...

guest · Dec 29, 2022

Play ransomware gang claims H-Hotels cyberattack
By Claudia Glover, December 21, 2022

The Play ransomware gang has claimed responsibility for a cyberattack on the H-Hotels chain which has left staff without access to email. The company’s name appeared on Play’s dark web victim blog, with the group stating it has a trove of data, including guest passport details.

H-Hotels operates across Germany, Austria and Switzerland, with 60 sites in 50 different locations. The company employs 2,500 people and operates six sub-brands: Hyperion, H4 Hotels, H + Hotels, H + Hostels and H.omes.
Click to expand...

Was data stolen in the H-Hotels cyberattack?
The chain suffered a cyberattack on December 11 that affected all its hotels. It has left hotel staff unable to receive or answer customer requests via email and so must continue to conduct business over the phone.

H-Hotels has confirmed an attack took place, but insists there is no evidence of any data leaving its systems.
Click to expand...

However, the post on Play’s victim blog alleges the gang has obtained information on the company. This is “private and personal data, clients documents, passports, ID,” it states.
Click to expand...

guest · Dec 30, 2022

Intrado ransomware attack claimed by Royal ransomware gang
SC Staff - December 29, 2022

BleepingComputer reports that telecommunications firm Intrado was claimed to have been attacked by the Royal ransomware gang.

Intrado has not confirmed the intrusion but sources noted that the telecommunications provider has been compromised since Dec. 1 and was asked to pay a $60 million ransom.
Click to expand...

Royal ransomware has claimed to have exfiltrated Intrado's internal documents, employee driver's licenses, and passports, and while none of the allegedly obtained data has been leaked, the ransomware gang has shared a 52.8 MB archive with scans of the stolen files.

Such a ransomware attack may be related to the massive outage across all Intrado's services around the same time.

"We are experiencing an issue with our internal network, Products are not impacted at this time. However, this may impact your ability to reach us via phone. The best method to contact support is by email or chat. We will provide an update when this situation is resolved and we apologize for any inconvenience," said Intrado in a Dec. 1 notice regarding the outage.
Click to expand...

guest · Dec 30, 2022

BlackCat Ransomware Targets Colombian Energy Supplier EPM
By Cristian Neagu - December 19, 2022

Empresas Públicas de Medellín (EPM), a Colombian energy provider, suffered from a BlackCat/ALPHV ransomware assault on Monday, which negatively impacted business operations and shut down internet services.

The company disclosed the incident to a Colombian media outlet, stating that it responded to a cybersecurity incident and provided alternative payment methods for its customers. The Prosecutor’s Office later confirmed that behind the attack was ransomware, which caused devices to be encrypted and data to be stolen.
Click to expand...

Threat Group BlackCat Ransomware Behind the Attack
As per BleepingComputer, the attacks were perpetrated by the BlackCat ransomware operation, also known as ALPHV, which claimed responsibility and said it had stolen corporate data from the Colombian company.

The encryptor sample and ransom notes from the EPM attack have also been examined by BleepingComputer, who has confirmed that they are from the BlackCat ransomware operation.
Click to expand...

The threat actors stole a quite a bit of data from EPM during the attack. Cybersecurity researcher Germán Fernández discovered a sample of BlackCat’s “ExMatter” data-theft tool uploaded to a malware analysis site from Colombia.

BlackCat ransomware attacks use ExMatter as a tool to steal data from business networks before devices are encrypted. The ransomware gang then employs this information in its double-extortion schemes.
Click to expand...

guest · Dec 30, 2022

LockBit ransomware claims attack on Port of Lisbon in Portugal
By Bill Toulas @billtoulas - December 30, 2022

An cyberattack hitting the Port of Lisbon Administration (APL), the third-largest port in Portugal, on Christmas day has been claimed by the LockBit ransomware gang.

The Port of Lisbon is part of the critical infrastructure in Portugal's capital city, being one of the most accessed ports in Europe, due to its strategic location, and serving container ships, cruise ships, and pleasure crafts.
Click to expand...

According to a company statement shared with local media outlets on Monday, the cyberattack did not impact the port's operations.

"All safety protocols and response measures provided for this type of occurrence were quickly activated, the situation being monitored by the National Cybersecurity Center and the Judicial Police," says the announcement shared with Portuguese national newspaper Publico.
At the time of writing, the port's official website at "portodelisboa.pt" remains offline.
Click to expand...

LockBit threatens data leak
APL didn't disclose the nature of the cyberattack in the announcement, but the LockBit ransomware group added the organization to its extortion site yesterday, thus claiming the attack.

The ransomware gang claims to have stolen financial reports, audits, budgets, contracts, cargo information, ship logs, crew details, customer PII (personally identifiable information), port documentation, email correspondence, and more.
The group has already published samples of the stolen data but BleepingComputer could not verify their legitimacy.
Click to expand...

LockBit threatens to publish all files they stole during the computer intrusion on January 18, 2022, if their payment demands aren't met.

As seen in the image above, the threat actor set the ransom to $1,500,000 and also gives the possibility to delay the publication of the data by 24 hours by paying $1,000.
Click to expand...

guest · Jan 1, 2023

Ransomware gang cloned victim’s website to leak stolen data
By Ionut Ilascu @Ionut_Ilascu - January 1, 2023

The ALPHV ransomware operators have gotten creative with their extortion tactic and, in at least one case, created a replica of the victim's site to publish stolen data on it.
Click to expand...

It appears that ALPHV, also known as BlackCat ransomware, is known for testing new extortion tactics as a way to pressure and shame their victims into paying.

While these tactics may not be successful, they introduce an ever-increasing threat landscape that victims need to navigate.
Click to expand...

Hackers make stolen data easier to get
On December 26, the threat actor published on their data leak site hidden on the Tor network that they had compromised a company in financial services.
As the victim did not meet the threat actor’s demands, BlackCat published all the stolen files as a penalty - a standard step for ransomware operators.

As a deviation from the usual process, the hackers decided to also leak the data on a site that mimics the victim's as far as the appearance and the domain name go.
Click to expand...

In total, there are 3.5GB of documents. ALPHV also shared the stolen data on a file-sharing service that allows anonymous uploading and distributed the link on its leak site.

This tactic could represent the start of a new trend that may be adopted by other ransomware gangs, especially since the costs to do it are far from significant.
Click to expand...

guest · Jan 2, 2023

Royal ransomware group claims it attacked Iowa PBS station
By Jonathan Greig @jgreigj - December 30, 2022

A ransomware group linked to a number of recent hacks said on Thursday that it was behind a cyberattack on the Iowa branch of the Public Broadcasting Service.
Click to expand...

Susan Ramsey, director of communications for Iowa PBS, told The Record that in the early hours of November 20, Iowa PBS “became aware of suspicious activity” on its network systems. “We swiftly brought in systems experts to help us identify the issue,” Ramsey said.

“Iowa PBS’s ability to serve Iowans has not been affected. The broadcast, livestreams and digital platforms are still operational and Iowa PBS will continue to educate, inform, enrich and inspire Iowans.”
Two days after Iowa PBS became aware of the incident, several local news outlets reported it cut short its annual fall fundraising pledge drive due to a cyberattack.
Click to expand...

On Thursday, the Royal ransomware group took credit for the attack but did not say what files they stole.
Iowa PBS is the latest news outlet to be attacked by ransomware groups in 2022.
Click to expand...

guest · Jan 3, 2023

Royal ransomware claims attack on Queensland University of Technology
By Bill Toulas @billtoulas - January 3, 2023

The Royal ransomware gang has claimed responsibility for a recent cyberattack on the Queensland University of Technology and begun to leak data allegedly stolen during the security breach.
Click to expand...

Queensland University of Technology (QUT) is one of the largest universities in Australia by the number of students (52,672), operating on a budget that surpasses one billion A$.
The university is focused on scientific, technological, engineering, and mathematical studies and has received significant government funding to back its research in recent years.
The university shut down all IT systems to prevent the attack's spread, and the university is working with external experts to respond to the security incident.

"Our university staff are working around the clock to assess the situation, restore services and limit disruption to students and academic progress," reads the QUT announcement.
Click to expand...

All students and personnel have been informed of the situation via notices, and a service status page has been created to report the restoration progress and service availability.
According to the latest updates from the university, there's no evidence that any data has been compromised due to the cybersecurity incident.
Royal gang releases allegedly stolen data
While the university says there is no evidence of data being stolen, the Royal ransomware operation has already begun publishing data that they claim was stolen from QUT.

In a new entry on their data leak site, the ransomware group leaked HR files, email and letter communications, ID cards and documents, and financial and administrative documents that they state represents 10% of the data stolen during the attack.
Click to expand...

guest · Jan 3, 2023

Rail giant Wabtec discloses data breach after Lockbit ransomware attack
By Bill Toulas @billtoulas - January 3, 2023

U.S. rail and locomotive company Wabtec Corporation has disclosed a data breach that exposed personal and sensitive information.
Click to expand...

Wabtec is a U.S.-based public company producing state-of-the-art locomotives and rail systems. The company employs approximately 25,000 people and has a presence in 50 countries, being the world's market leader in freight locomotives and a major player in the transit segment.

The firm's 2021 financial results give a revenue figure of $7.8 billion, reporting a staggering 20% of the world's freight being moved by the 23,000 of Wabtec's locomotives in global operation.
Click to expand...

Wabtec discloses a data breach
In an announcement published at the end of the year, Wabtec says hackers breached their network and installed malware on specific systems as early as March 15th, 2022.
[...] news outlets reported that sources at one of Wabtec's plants indicated that it was a ransomware attack impacting the rail giant. However, the company did not officially respond to the rumors.

A couple of weeks later, LockBit published samples of data stolen from Wabtec and eventually leaked all stolen data on August 20th, 2022, presumably after a ransom was not paid.
As Wabtec explains now, its investigation of the incident was concluded on November 23rd, 2022, when data review specialists confirmed that LockBit had stolen files containing sensitive personal information.
Click to expand...

guest · Jan 3, 2023

Hackers claim ransomware attack on Los Angeles housing authority
By Carly Page @carlypage_ - January 3, 2023

The Housing Authority of the City of Los Angeles, or HACLA, has confirmed it is investigating a cybersecurity incident shortly after the LockBit ransomware gang claimed responsibility for a cyberattack on the agency.
Click to expand...

HACLA, which provides affordable housing to more than 19,000 low-income families across Los Angeles, was added to LockBit’s dark web leak site on December 31. The listing, seen by TechCrunch, claims that LockBit has stolen 15 terabytes of data from the housing agency.

Screenshots posted by the cybercriminals suggest the data includes the personal details of people who sought housing assistance from the city, as well as data from the city agency’s payroll, human resources and accountancy files.
In a statement given to TechCrunch, HACLA spokesperson Courtney Gladney declined to comment on specifics, but said that HACLA is experiencing “a cyber event” that resulted in “disruption” to the agency’s systems.
Click to expand...

LockBit’s claimed attack on HACLA marks the second major cyberattack on a Los Angeles city agency in recent months.
Click to expand...

guest · Jan 9, 2023

San Francisco BART investigating ransomware attack
By Jonathan Greig @jgreigj - January 9, 2023

San Francisco’s Bay Area Rapid Transit (BART) is investigating an alleged ransomware attack after the Vice Society ransomware gang claimed to have attacked the agency.
Click to expand...

BART – the fifth-busiest heavy rail rapid transit system in the United States – was listed on the group’s leak site on Friday. Alicia Trost, chief communications officer for BART, told The Record that they are investigating the data that was stolen and posted by the group.

“To be clear, no BART services or internal business systems have been impacted,” she said. “As with other government agencies, we are taking all necessary precautions to respond.”
While the attack did not cause any damage and no riders were put at risk, city officials raised alarms in a report because the attackers could have reached critical systems and may have left backdoors inside.
Click to expand...

The rail industry has seen its fair share of cyberattacks in recent years.
Just last week, one of the world’s largest rail and locomotive companies announced a data breach that involved troves of employee information following an alleged ransomware attack last summer.
Click to expand...

guest · Jan 12, 2023

Vice Society ransomware claims attack on Australian firefighting service
By Bill Toulas @billtoulas - January 12, 2023

Australia's Fire Rescue Victoria has disclosed a data breach caused by a December cyberattack that is now claimed by the Vice Society ransomware gang.
Click to expand...

Fire Rescue Victoria (FRVP) is a fire and rescue service operating across 85 stations in the Australian state of Victoria that has approximately 4,500 operational and corporate employees.

The cyberattack on FRV occurred on December 15, 2022, and despite the widespread and ongoing IT outages it has caused, the agency's emergency response services have not been impacted.

"The incident affected a number of our internal servers, including our email system," explains FRV in an announcement on its site.
Click to expand...

In addition to disrupting the agency's IT system, the hackers have also stolen data from FRV's computers, including information about current and former employees, contractors, secondees, and job applicants.

According to parts of the notice that were made public, the hackers have stolen the following information on FRV staff and applicants: [...]
In addition to the above, because the hackers accessed the agency's email system, which remains offline, they may also have accessed or stolen sensitive email communications.
Click to expand...

Attack claimed by Vice Society Ransomware
This data breach notifications comes after the Vice Society ransomware gang claimed to be behind the attack on Fire Rescue Victoria and indicated they would start leaking stolen data.
On January 10th, an entry for Fire Rescue Victoria appeared on Vice Ransomware's Tor data leak site, with a link to allegedly stolen data.

However, this link currently does not work, granting the fire rescue organization a likely unintended reprieve from their data becoming public.
Click to expand...

guest · Jan 16, 2023

Vice Society ransomware leaks University of Duisburg-Essen’s data
By Bill Toulas @billtoulas - January 16, 2023

The Vice Society ransomware gang has claimed responsibility for a November 2022 cyberattack on the University of Duisburg-Essen (UDE) that forced the university to reconstruct its IT infrastructure, a process that's still ongoing.
Click to expand...

The threat actors have also leaked files they claim to have stolen from the university during the network breach, exposing potentially sensitive details about the university's operations, students, and personnel.

UDE has since confirmed that they are aware the threat actors published the stolen data and said that they will not be paying a ransom.

"After the cyber attack on the University of Duisburg-Essen (UDE) at the end of November, the criminal group responsible for it has now published data on the Darknet," UDE said in a statement.
"The university had not complied with the attackers’ demands and had not paid a ransom."
Click to expand...

Rebuilding UDE's IT infrastructure
The cyberattack was disclosed by UDE on November 28th, 2022, forcing the university to shut down all email, communications, and IT systems until further notice. The university also canceled the planned exams right before the Christmas holiday.
However, UDE was still far from returning to normal operations.

As for the impact of the (claimed) Vice Society attack on UDE, the university has 43,000 students, 4,000 academic staff, and 1,500 administrative staff. It is considered the top German university in the physics field.
Click to expand...

guest · Jan 18, 2023

CL0P adds the New York City Bar Association to their leak site
January 13, 2023

The CL0P ransomware gang has added the NYC Bar Association to their leak site today.
Click to expand...

Unsurprisingly, the threat actors have some unkind words for their victim:

The New York City Bar is example of one more institution who not take their obligation to secure client, employee and case data seriously. We download more than 1.8tb of data and now is time to have some lawsuits started and fines for neglecting their duties. Every single system was locked back in mid-December yet the organization said nothing to anyone to try and keep it all under wraps. Data size is so large we have to share over some weeks.
As proof of claims, CL0P provided a screenshot of a portion of a file directory, redacted by DataBreaches.
Click to expand...

In addition to the above, CL0P also posted screenshots of passports for a number of individuals. Why the NYC Bar is in possession of those passports was not made clear on the leak site.
Click to expand...

guest · Jan 23, 2023

PLAY ransomware group claims attack on Arnold Clark, one of Britain’s largest car dealerships
By Alexander Martin @AlexMartin - January 23, 2023

Sensitive personal data allegedly stolen from Arnold Clark, one of the United Kingdom’s largest car dealerships, has been posted online by the PLAY ransomware group.
Click to expand...

The company had claimed in a Tweet on January 3 to have protected customer data after it discovered suspicious traffic on its network back in December, although it did not confirm the nature of the attack.

“Our priority has been to protect our customers’ data, our systems and our third-party partners,” the company stated, adding that “this has been achieved.”
Its statement has not been updated following the publication last week of what appear to be customer details on the PLAY ransomware group’s extortion site.
Click to expand...

The data includes National Insurance numbers (the equivalent of Social Security numbers in the U.S.) and passport data, alongside addresses and phone numbers. Also published were bank statements and car finance documents for customers of the Glasgow-based business.
Data belonging to private and corporate customers is believed to be included in the leak.

Arnold Clark, which employs more than 11,000 people across 193 dealerships in Britain, stated the attack had “caused temporary disruption to our business and unfortunately our customers” and apologized for any inconvenience it caused.
Click to expand...

guest · Jan 24, 2023

Ohio town working to restore municipal court systems after cyberattack
By Jonathan Greig @jgreigj - January 24, 2023

An Ohio town is investigating a cyberattack that has brought down the systems used by their court and may have accessed sensitive data.
Click to expand...

Circleville Municipal Court told The Record that it recently discovered a cyberattack requiring its IT department to work with outside cybersecurity professionals.

A spokesperson would not confirm whether the incident involved ransomware but the Circleville Municipal Court was added to the leak site of the LockBit ransomware group last week. The group claimed it stole 500 GB of data that included case information and gave the court a deadline of January 24 to pay a ransom.

“We are working around the clock with these experts to ensure that our systems are restored and back up and running as soon as possible. As part of our investigation, we are assessing the extent of any compromise of information as a result of this incident,” a court spokesperson said.
Click to expand...

The attack comes just weeks after another town in Ohio, Mount Vernon, said its police department, municipal court and other government offices were affected by a ransomware attack that started on December 19.
Click to expand...

guest · Jan 27, 2023

BlackCat Ransomware gang stole secret military data from an industrial explosives manufacturer
By Pierluigi Paganini - January 27, 2023

The BlackCat Ransomware gang added SOLAR INDUSTRIES INDIA to the list of victims published on its Tor leak site. The company is a globally recognised industrial explosives manufacturer, it provides complete blasting solutions, including packaged, bulk explosives and initiating systems to meet its customer needs across the globe.
Click to expand...

The BlackCat Ransomware group claims to have breached the company infrastructure and to have stolen 2TB of data, including secret military data related to weapons production.

“Because of low security, more than 2TB of sensitive data related to weapons production was stolen from Solar Industries India Limited.” reads the message published on the leak site. “The data leakage affected all products and classified documents of the company. The data includes full descriptions of engineering specifications, drawings, audits of many weapons, among others:
Click to expand...

BlackCat published images of the stolen documents and pictures taken from the company’s security cameras as proof of the hack.

The group invites anyone wishing to bid on all Solar Group data within 24 hours of the publication of its blog to contact them in TOX.
Click to expand...

guest · Jan 31, 2023

Ransomware attack on Indianapolis Housing Agency leaks sensitive info on 200,000 residents
By Jonathan Greig @jgreigj - January 30, 2023

The Indianapolis Housing Agency is notifying more than 200,000 people that their information, including Social Security numbers and more, was leaked during a ransomware attack in that began in September.
Click to expand...

The federally-funded agency is responsible for providing housing to low-income tenants across Indianapolis. It did not respond to requests for comment in October when the attack was revealed but reported the incident to the Maine Attorney General’s office last week, explaining that 212,910 people were affected.

The agency submitted two separate versions of the breach notification letter – one for adults affected and one for children who had information leaked in the incident.
In the letters, the agency says the ransomware attack was discovered on October 4 when they noticed unusual activity in their IT environment. They noted that the breach started on September 23.
Click to expand...

Security experts were hired to investigate the incident and it was revealed that names, addresses, dates of birth and Social Security numbers were leaked during the attack.
Click to expand...

guest · Feb 1, 2023

LockBit takes credit for November ransomware attack on Sacramento PBS station
By Jonathan Greig @jgreigj - January 31, 2023

The LockBit ransomware group this week said it was responsible for a November ransomware attack on a public broadcasting affiliate in Sacramento, California.
Click to expand...

The high-profile cybercrime gang made the claim on the dark web site where it leaks victims’ data.

The PBS station KVIE announced the attack on November 23, noting that some of its internal systems were affected on October 31. It immediately took systems offline, notified law enforcement and hired experts to investigate the incident.
Click to expand...

The station’s mission-critical systems are segmented from the business network, meaning the website and broadcast were not affected, and the group did not gain access to the station’s payroll, membership or accounting systems.

“Because of their dedication, we remained on air throughout, continuing to provide our community with the important programming it expects,” KVIE president and general manager David Lowe said in a statement at the time.
Lowe confirmed that a ransom was demanded by LockBit, which the station decided not to pay, instead restoring what it could from backups.
Click to expand...

On Tuesday, Lowe told The Record that nothing has changed since his statement in November other than the fact that LockBit is now threatening to leak the data stolen during the attack.
Click to expand...

guest · Feb 1, 2023

mood said: ↑

PLAY ransomware group claims attack on Arnold Clark, one of Britain’s largest car dealerships
By Alexander Martin @AlexMartin - January 23, 2023
Click to expand...

Arnold Clark customer data stolen in attack claimed by Play ransomware
By Sergiu Gatlan @serghei - February 1, 2023

Arnold Clark, self-described as Europe's largest independent car retailer, is notifying some customers that their personal information was stolen in a December 23 cyberattack claimed by the Play ransomware group.
Click to expand...

The company said in emails sent to affected clients on Tuesday that the stolen data includes ID information and banking details.

"During this incident, it appears that some personal data stored in our network may have been stolen, including names, contact details, dates of birth, vehicle details, ID documents (such as passports and driver's licenses), National Insurance numbers (in limited cases) and bank account details," the car retailer said.
"Upon advice from our cyber security team, we understand the some personal data has been extracted by the hackers who carried out the cyber attack."
Click to expand...

Customers warned of phishing attacks
Affected customers were advised to be wary of potential phishing attacks targeting them due to this breach and not to open attachments or click links embedded in suspicious-looking emails.

The company first acknowledged the incident on January 3, 2023, when it said the attack caused "temporary disruption" to its business operations.
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches