With companies coming forward every day announcing impacts from their third-party cloud data storage vendor, the Snowflake data breach seems to be snowballing into one of the biggest data breaches of the digital age. Here's everything to know about the Snowflake breach; we'll update this page as new information becomes available.

Why the Snowflake Breach Matters

Snowflake is a prominent U.S.-based cloud data storage and analytics company, with over 9,800 global customers. Its customer base includes major corporations like Adobe, AT&T, Capital One, DoorDash, HP, JetBlue, Mastercard, Micron, NBC Universal, Nielsen, Novartis, Okta, PepsiCo, Siemens, US Foods, Western Union, and Yamaha, among others. Snowflake holds approximately a 20% share of the data warehouse market and was recently ranked #1 on the Fortune Future 50 List, it an attractive target for cybercriminals. However, it is crucial to note that the breaches are not necessarily due to failures by Snowflake. The correlation does not imply causation, as emphasized by Snowflake’s Chief Information Security Officer Brad Jones. The company, along with its forensic partners, found no evidence of vulnerabilities or breaches within Snowflake’s platform.

Ongoing Investigation and Preliminary Results in Snowflake Breach

On May 31, Snowflake revealed that attackers accessed customer accounts using single-factor authentication. According to preliminary results, these attackers leveraged credentials obtained through infostealing malware.

Compromised Employee Account

Snowflake confirmed that a threat actor obtained credentials from a single former employee, accessing demo accounts that were isolated from production and corporate systems. Snowflake’s core systems are protected by Okta and Multi-Factor Authentication (MFA) but the demo accounts lacked such safeguards.

Test Environments Targeted

Demo accounts are often overlooked as security risks. Despite assurances that these accounts do not contain sensitive data, they remain attractive targets due to their perceived value. Cybercriminals exploit the perception gap, knowing that a claimed breach of a high-profile company like Snowflake can generate significant media attention.

Attack Path

The initial access point for the attackers was almost certainly compromised credentials obtained through infostealing malware. Mandiant, who helped Snowflake in its investigation, confirmed that the compromised credentials were from customer instances and were traced back to infostealer malware logs. Several variants of infostealer malware were used, including VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA, and METASTEALER.

Possible Reasons for the Breach

Mandiant confirmed that there was no breach of Snowflake’s enterprise environment. They identified that most credentials used by the attackers originated from historical infostealer infections. The lack of MFA and failure to rotate credentials for up to four years were significant factors. Network allow lists were also not used to restrict access to trusted locations.

Unconfirmed Threat Actor Claims

The threat actor also claimed to have logged into Snowflake’s ServiceNow using the same credentials. This claim has neither been confirmed nor explicitly refuted by Snowflake. Other unknowns include whether similar methods compromised other Snowflake employees, and the definition of "sensitive" data used for determining the impact on demo accounts. The investigation is ongoing, but Snowflake stands by its initial findings.

Affected Customers from Snowflake Breach

The data breaches began in April 2024, and the company claimed it had impacted a “limited” number of Snowflake customers. Snowflake initially did not disclose the exact number or the names of all affected customers. However, a comprehensive report from Mandiant two weeks after the initial disclosure revealed that 165 customers were impacted in the Snowflake data breach. While some victims have been identified through attackers’ offers to sell stolen data, others were revealed via mandatory public disclosures. Most companies have yet to confirm the impact. Following is a list of all companies know to have been impacted in the Snowflake data breach:

• Santander Group: The company confirmed a compromise without mentioning Snowflake.
• Impact: Santander Bank staff and 30 million customers’ data has allegedly been breached.

• TicketMaster (Live Nation Entertainment subsidiary): Confirmed via an SEC 8-K report, with Snowflake identified as the third party involved.
• Impact: 560 Million TicketMaster user details and card info potentially at risk.

• LendingTree: Notified by Snowflake about a potential data impact involving QuoteWizard.
• Impact: On June 1, a hacker going by the name “Sp1d3r” posted on the cybercriminal platform BreachForums that they had stolen the sensitive information of over 190 million people from QuoteWizard. The alleged database included customer details, partial credit card numbers, insurance quotes and other information.

• Advance Auto Parts: Unconfirmed by the company, but a dark web listing claimed significant data theft.
• Impact: Same actor as LendingTree claimed leak of 380 million customers and 358,000 former and current employees.

• Pure Storage: The Pure Storage data breach involved a third party temporarily gaining access to the workspace, which housed data such as company names, LDAP usernames, email addresses, and the Purity software release version number.
• Impact: The same threat actor known as “Sp1d3r” claimed responsibility, alleging the theft of 3 terabytes of data from the company’s Snowflake cloud storage that was reportedly being sold for $1.5 million.

Tech Crunch discovered over 500 login credentials and web addresses for Snowflake environments on a website used by attackers to search for stolen credentials. These included corporate email addresses found in a recent data dump from various Telegram channels.

Security Measures and Customer Support

Snowflake Chief Information Security Officer Brad Jones reiterated the company's findings, asserting that the breaches were not due to any vulnerabilities, misconfigurations, or breaches of Snowflake’s platform or personnel credentials. Snowflake is collaborating with customers to enhance security measures and plans to mandate advanced security controls such as multi-factor authentication (MFA) and network policies, especially for privileged accounts. The company acknowledges the friction in their MFA enrollment process and is working to streamline it. The shared responsibility model places MFA enforcement on customers, but Snowflake aims to make it a standard prerequisite due to the high sensitivity of the data stored in their cloud environments.

Key Recommendations for Snowflake Customers:

1. Enforce Multi-Factor Authentication: Make MFA mandatory for all accounts, particularly those with privileged access.
2. Regularly Rotate Credentials: Ensure that all credentials are regularly updated to prevent long-term exposure from previous leaks.
3. Implement Network Allow Lists: Restrict access to trusted IP addresses to minimize unauthorized access.
4. Enhance Logging and Monitoring: Improve logging and monitoring capabilities to detect and respond to suspicious activities promptly.

Snowflake has also published indicators of compromise and steps for detecting and preventing unauthorized user access here. Cloud security firm Permiso has developed an open-source tool dubbed "YetiHunter" to detect and hunt for suspicious activity in Snowflake environments based on the IoCs shared by Snowflake, Mandiant, DataDog, and its own intelligence. Editor's Note: This blog will be updated as additional breach information from Snowflake and its customers becomes available or is claimed by threat actors on underground forums for sale. Links and data to any additional IoCs related to the Snowflake breach will be published here too.

Hacktivist group 177 Members Team has claimed a cyberattack on Malaysia's leading internet service provider, Unifi TV. The Unifi TV cyberattack was posted on a dark web leak site, highlighting crucial details about the organization with links shared to confirm the intrusion. Unifi TV, a subsidiary of Telekom Malaysia Berhad, offers a range of services including internet access, VoIP, and IPTV. The threat actor claimed this attack on June 12, 2024, and took responsibility for compromising Unifi TV's systems and launching multiple Distributed Denial of Service (DDoS) attacks against the company.

177 Members Team Claims Unifi TV Cyberattack

[caption id="attachment_77209" align="alignnone" width="525"] Source: Dark Web[/caption] The cyberattack on Unifi TV was aimed at disrupting the operation of the organization and highlighted the importance of robust cybersecurity measures in safeguarding critical digital infrastructure. Despite claims by the threat actor that the Unifi TV website was down, the web pages seem to be operational at the moment and don’t show any immediate sign of the cyberattack. The impact of the cyberattack extends beyond Unifi TV, affecting not only the telecommunications industry but also posing a threat to Malaysia's digital ecosystem as a whole. With the country witnessing over 3,000 cyber attacks daily, according to Defence Minister Datuk Seri Mohamed Khaled Nordin, the cyberattacks on Malaysia highlights the growing nature of ransomware groups and hacktivist collectives targeting the nation. 

Previous Cybersecurity Incidents

While Unifi TV has yet to release an official statement regarding the cyberattack, concerns about data breaches have been previously raised. In July 2023, Telekom Malaysia issued a data breach alert to Unifi users, stating that personal information, including names, identification numbers, and contact details, may have been compromised. The company assured users that measures had been taken to contain the breach and protect customer data. In light of these incidents, cybersecurity experts emphasize the need for proactive measures to mitigate future threats. Collaborative efforts between government agencies, law enforcement, and private sector entities are crucial in addressing online threats that target Asian nations. As for the current Unifi TV cyberattack claims, this is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the alleged attack or any official confirmation from the organization.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The U.S. food chain giant Panera Bread has begun notifying its employees of a significant data breach that occurred as a result of a ransomware attack in March 2024. The company, along with its franchises, operates 2,160 cafes under the names Panera Bread or Saint Louis Bread Co, spread across 48 states in the U.S. and Ontario, Canada. The Panera Bread data breach was disclosed in notification letters filed with the Office of California's Attorney General, where Panera detailed its response to what it termed a "security incident." Upon detecting the Panera Bread data breach, the company acted swiftly to contain it, enlisting external cybersecurity experts to investigate and inform law enforcement of the situation. The files involved were reviewed, and on May 16, 2024, we determined that a file contained your name and Social Security number. Other information you provided in connection with your employment could have been in the files involved. As of the date of mailing of this letter, there is no indication that the information accessed has been made publicly available," reads Panera's official notification.

Panera Bread Data Breach: Impact on Employees and Operations

The ransomware attack has had substantial repercussions on Panera's operations and its employees. Many of Panera's virtual machine systems were reportedly encrypted during the attack, leading to a significant outage that crippled internal IT systems, phones, point of sale systems, the company’s website, and mobile apps. During this outage, employees were unable to access their shift details and had to contact their managers to obtain work schedules. The stores faced further disruption as they could only process cash transactions, with electronic payment systems down. Additionally, the rewards program system was inoperable, preventing members from redeeming their points. The most concerning aspect of the breach for employees is the compromise of sensitive personal information. Panera has confirmed that files containing employee names and Social Security numbers were accessed. There is also the potential that other employment-related information was compromised. However, the company has assured employees that, as of the notification date, there is no evidence that the accessed information has been publicly disseminated. To mitigate the potential impact on affected individuals, Panera is offering a one-year membership to CyEx's Identity Defense Total, which includes credit monitoring, identity detection, and identity theft resolution services. This proactive measure aims to help employees safeguard their identities and respond swiftly to any signs of fraudulent activity.

The Bigger Picture: Unanswered Questions

Despite the detailed notifications to employees, Panera has yet to publicly disclose the total number of individuals impacted by the breach. The identity of the threat actors behind the ransomware attack also remains unknown. No ransomware group has claimed responsibility, which raises speculation that the attackers might be awaiting a ransom payment or have already received it. Moreover, Panera has not responded to requests for comment from The Cyber Express regarding the outage and the ransomware attack. This lack of communication leaves several critical questions unanswered, particularly about the measures being taken to prevent future incidents and the ongoing efforts to recover from the current breach.

Implications for Panera Bread Data Breach

The implications of this ransomware attack extend beyond the immediate disruption and data breach. Panera Bread's reputation is at stake, as customers and employees alike may question the company's ability to protect sensitive information. The operational disruptions also highlight vulnerabilities in the company’s IT infrastructure that need to be addressed to prevent similar incidents in the future. In response to the data breach, Panera has committed to enhancing its existing security measures. The company is likely to conduct a thorough review of its cybersecurity policies and practices to identify and address any gaps. Additionally, ongoing communication with employees and stakeholders will be crucial in rebuilding trust and ensuring that all affected parties are adequately supported. As the investigation continues, further details may emerge about the nature of the breach and the steps Panera is taking to strengthen its defenses.

A threat actor on a dark web forum has listed data from Truist Bank for sale following a cyberattack on the banking institution. Meanwhile, Kulicke and Soffa Industries, Inc. (K&S) is also dealing with a data breach. Reports indicate that Truist Bank client data, including sensitive information such as employee details and bank transactions, has been put up for sale on the dark web. The alleged Truist Bank data leak is attributed to a threat actor known as Sp1d3r. The data, reportedly obtained via the Snowflake breach, raises questions about the security measures in place at Truist Bank.

Truist Bank Data Breach Allegedly Goes on Sale on Dark Web

According to the threat actor’s post, the Truist Bank data breach is now selling for $1 million. The compromised data includes details of 65,000 employees, bank transactions containing names, account numbers, balances, and the source code for IVR funds transfers. [caption id="attachment_77051" align="alignnone" width="595"] Source: Dark Web[/caption] The post by the threat actor provides specific information about the data for sale and contact details for purchase. Additionally, the post includes various usernames, threads, reputation points, and contact information such as XMPP handles and email addresses associated with the threat actor. Meanwhile, Kulicke and Soffa Industries, a renowned semiconductor and electronics manufacturing company, disclosed a breach compromising millions of files. Initially detected on May 12, 2024, the breach exposed critical data, including source codes, engineering information, and personally identifiable information.

Two Cybersecurity Incidents at Once

In response to the Kulicke and Soffa data breach, K&S swiftly initiated containment measures in collaboration with cybersecurity experts and law enforcement agencies. The company's cybersecurity team worked diligently to isolate affected servers and prevent further intrusion. Despite the breach, K&S remains committed to safeguarding its systems and data integrity. In a filing with the U.S. Securities and Exchange Commission (SEC), K&S detailed its efforts to mitigate the impact of the breach. The company assured stakeholders that, as of the filing date, the incident had not materially disrupted its operations. However, investigations are ongoing to ascertain the full extent of the breach and increase the cybersecurity measures in place. The Truist Bank data breach and the Kulicke and Soffa cyber incident highlight the persistent threat of cyberattacks faced by organizations worldwide. While both entities are actively addressing the breaches, the incidents highlight a broader case of cybersecurity measures and their impact in safeguarding sensitive information and maintaining trust in the digital age. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Life360 Inc., the parent company of Tile, has recently disclosed that it was the victim of a criminal extortion attempt involving stolen customer data. The incident, the Life360 data breach, which was communicated by CEO Chris Hulls, highlights the growing threat of cyberattacks targeting companies that handle large amounts of user information. Chris Hulls, CEO of Life360 Inc., provided details about the extortion attempt in an official release: "Similar to many other companies, Life360 recently became the victim of a criminal extortion attempt. We received emails from an unknown actor claiming to possess Tile customer information." Upon receiving these emails, Life360 swiftly initiated an investigation. The company detected unauthorized access to a Tile customer support platform, though notably, the breach did not affect the Tile service platform itself. The compromised data includes customer names, addresses, email addresses, phone numbers, and Tile device identification numbers. Crucially, it does not include sensitive information such as credit card numbers, passwords, log-in credentials, location data, or government-issued identification numbers, as these were not stored on the affected support platform. "We believe this incident was limited to the specific Tile customer support data described above and is not more widespread," Hulls assured. We take this event and the security of customer information seriously. We have taken and will continue to take steps designed to further protect our systems from bad actors, and we have reported this event and the extortion attempt to law enforcement. We remain committed to keeping families safe online and in the real world."

About Tile and Life360

Tile, much like Apple's AirTag, produces small Bluetooth-enabled devices that help users locate and track items such as keys, wallets, and bags. These devices work in conjunction with a mobile app, allowing users to find lost items using sound alerts or by viewing the last known location of the Tile tracker on a map. Tile is a subsidiary of Life360, the leading connection and safety app used by one in nine U.S. families. With over 66 million members, Life360 offers driving, location, and digital safety features that keep loved ones connected. The app's extensive user base makes the implications of any data breach potentially far-reaching.

Implications of the Life360 Data Breach

While the Life360 data breach did not include highly sensitive data, the exposure of personal information such as names, addresses, and phone numbers can still have significant implications. Such data can be used for targeted phishing attacks, identity theft, and other malicious activities. The breach highlights the importance of cybersecurity measures, particularly for companies managing large databases of personal information. Life360's swift response to the incident and its cooperation with law enforcement demonstrates the company's commitment to transparency and user security.

Moving Forward

In response to the breach, Life360 has reiterated its commitment to enhancing its security infrastructure and safeguarding user information. The company is taking proactive steps to prevent future cybersecurity incidents, including strengthening its cybersecurity protocols and continuing to monitor its systems for potential vulnerabilities. "We remain committed to keeping families safe online and in the real world," Hulls emphasized. The company’s prompt action and transparent communication are crucial in maintaining user trust and addressing concerns related to the breach.

Ascension, a leading healthcare provider, has made significant progress in its investigation and recovery efforts following a recent cyberattack. With the help of third-party cybersecurity experts, Ascension has identified the extent of the Ascension cyberattack and the steps needed to protect affected individuals. Ascension reports that attackers managed to steal files from a few servers within its network. Specifically, seven out of approximately 25,000 servers, primarily used by associates for daily tasks, were compromised. These servers might contain Protected Health Information (PHI) and Personally Identifiable Information (PII) for certain individuals. "We now have evidence that attackers were able to take files from a small number of file servers used by our associates primarily for daily and routine tasks. Though we are still investigating, we believe some of those files may contain PHI and PII for certain individuals, although the specific data may differ from individual to individual," said an Ascension spokesperson.

What Caused Ascension Cyberattack?

The cyberattack on Ascension was traced back to an innocent mistake by an employee who accidentally downloaded a malicious file, mistaking it for a legitimate one. "We have also identified how the attacker gained access to our systems. An individual working in one of our facilities accidentally downloaded a malicious file that they thought was legitimate. We have no reason to believe this was anything but an honest mistake," informed the spokesperson. This incident highlights the importance of continuous cybersecurity training and vigilance among all employees to prevent such occurrences in the future. Ascension has assured its patients and associates that there is no evidence suggesting any data was taken from the Electronic Health Records (EHR) system or other clinical systems where comprehensive patient records are securely stored. This means the most sensitive health information remains uncompromised, providing some relief amidst the ongoing investigation.

Ongoing Review and Protective Measures

Ascension is currently conducting a detailed review and analysis of the potentially impacted files to determine precisely what data was affected and identify the individuals involved. This meticulous process is expected to take considerable time due to the volume and complexity of the data. In the meantime, Ascension is taking proactive steps to protect its patients and associates. The healthcare provider is offering free credit monitoring and identity theft protection services to all patients and associates, regardless of whether their data is eventually found to be compromised. This service is intended to provide immediate peace of mind and mitigate potential risks from the Ascension data breach. Individuals who wish to enroll in these protective services are encouraged to contact Ascension's dedicated call center at 1-888-498-8066.

Commitment to Transparency and Legal Compliance

Ascension remains committed to transparency throughout this investigation. While specific details regarding whether an individual's data was affected cannot be provided, Ascension pledges to follow all applicable laws and regulations related to data breach notifications. "We encourage all Ascension patients and staff who are concerned to take advantage of these services. We want to be clear that this offer does not mean we have determined that any specific individual patient’s data has been compromised. Rather, it illustrates our desire to do everything possible to reassure our patients and associates, regardless of any impact to specific individuals’ data," the spokesperson explained. "Once our data analysis is complete, we are committed to following all applicable laws and regulations to notify affected individuals and the appropriate regulatory bodies. To our patients, associates, and the communities we serve, we regret any disruption or concern you may have experienced as a result of this incident," the spokesperson added.

Background and Impact of Cyberattack on Ascension

On May 10, The Cyber Express reported that Ascension faced disruptions in clinical operations due to a cyberattack that prompted the organization to take some of its systems offline. Operating in 19 states and the District of Columbia, Ascension oversees 140 hospitals and 40 senior care facilities. It also boasts a significant workforce of 8,500 providers, 35,000 affiliated providers, and 134,000 associates. In 2023, Ascension’s total revenue amounted to $28.3 billion. Given its substantial revenue and widespread operations, the impact of this cyberattack was significant. The organization detected unusual activity on select technology network systems, prompting an immediate response, investigation initiation, and activation of remediation efforts. Due to the cyberattack, Ascension advised its business partners to temporarily sever connections to its systems as a precautionary measure and stated it would notify partners when it is safe to reconnect. The cyberattack on Ascension disrupted clinical operations, prompting an investigation into the extent and duration of the disruption.

A resident of Moreton Bay, Australia was shocked to discover that the private information of several resident ratepayers in the region, including their friends and neighbors, had been accidentally published on the Moreton Bay council's official website. The leaked information included names, residential addresses, email addresses, and phone numbers, as well as resident complaints to the council and details about council investigations.

Data Breach Discovered By Local Resident

City of Moreton Bay resident Piper Lalonde, who works as a data analyst, had discovered the breach along with her husband. They were shocked to learn that their personal information was freely available on the council's customer request online portal. The couple had discovered that the information included their phone numbers,  complaints, and requests that they had made for new bins, along with the GPS coordinates of where the requests had been filed. A further investigation into the breach had revealed that the personal information of some of their friends and neighbors who were fellow ratepayers were also available in the records after they conducted a search. Piper reported this information to the council, with the website being taken down the next day. However, she was still unsatisfied with the lack of notification about the incident to impacted residents. Piper stated, "I would expect they'd have to send out some formal communication letting people know their information was publicly accessible, but there was no indication they were going to do that." She expressed concern about the possibility of people stumbling upon complaints made about them by other residents. She added, "If this gets in the wrong hands — it just takes one person to see a complaint about them, and who knows what they'll do."

City of Moreton Bay Responses to Data Breach

After Piper's report, the website was said to be taken down. The site appears to be functional as of now, with some functions still limited. The website includes an official notice in response to the incident. [caption id="attachment_76878" align="alignnone" width="2204"] Source: moretonbay.qld.gov.au[/caption]

We are experiencing system difficulties with our customer request portal. Our third-party provider is investigating a possible information breach. The cause is yet to be determined but there is no indication this is a cyber attack. We will never contact you via unsolicited calls to request sensitive information. No action is required from you at this stage. We will continue to keep you informed.

The notice appears to indicate that the breach stemmed from a third-party provider. The Cyber Express team has reached out to the Moreton Bay Council's Privacy Officer for further information on the breach, however no response has been received as of publication time. The potential scale of the data breach, as well as its impact on residents, is currently unknown. It is also unclear on how many individuals may have accessed the available data before the website had been temporarily taken down and subsequently limited. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The MEDUSA ransomware group has reared its ugly head again and this time it has claimed to have targeted three new victims: GEMCO Constructors, Dynamo Electric and Farnell Packaging. The ransomware group’s dark web portal highlighted these additions, adding to their growing list of victims. Like many of its earlier attacks, the group has not disclosed crucial details, such as the type of compromised data. It has, however, demanded a bounty of US $900,000 from GEMCO and $100,000 each from Dynamo and Farnell Packaging to stop leaking its internal data.

MEDUSA Ransomware Attack: The Latest Victims

GEMCO Constructors is headquartered in Indianapolis, Indiana, USA. The ransomware actors have claimed to have access to 1.0 TB of the organization's data and has threatened to publish it within 6-7 days. The second company that the group has claimed to have targeted is Dynamo, which is based in Saskatchewan, Canada. Data of the company, which specializes in electrical and electronic manufacturing, has allegedly been compromised. MEDUSA has claimed to have exfiltrated 149.6 GB of the organization's data and plans to publish it within 6-7 days. Farnell Packaging, a Canadian company in the packaging and container industry, has also allegedly been attacked. The attackers claimed to have accessed 193.9 GB of the organization's data and warned the data would be published within 8–9 days. Despite the gigantic claims made by the ransomware group, the official websites of the targeted companies seem to be fully operational, with no signs of foul play. The organizations, however, have not yet responded to the alleged cyberattack, leaving the claims made by the ransomware group unverified.  The article would be updated once the respective organizations respond to the claims. The absence of confirmation raises the question of the authenticity of the ransomware claim. It remains to be seen whether it is a tactic employed by MEDUSA to garner attention or if there are ulterior motives attached to their actions. Only an official statement by the affected companies can shed light on the true nature of the situation. However, if the claims made by the MEDUSA ransomware group do turn out to be true, then the consequences could be far-reaching. The potential leak of sensitive data could pose a significant threat to the affected organizations and their employees.

Background of MEDUSA Ransomware Group

MEDUSA first burst onto the scene in June 2021 and has since targeted organizations in various countries across multiple industries, including healthcare, education, manufacturing, and retail. Most of the companies, though, have been established in the United States of America. MEDUSA functions as a Ransomware-as-a-Service (RaaS) platform. It provides would-be attackers with malicious software and infrastructure required to carry out disruptive ransomware attacks. The ransomware group also has a public Telegram channel that threat actors use to post data that might be stolen, which could be an attempt to extort organizations and demand payment.

Previous Ransomware Attacks

Less than three weeks ago, MEDUSA ransomware group claimed a cyberattack on Comwave, a Canadian communications giant renowned for providing internet, network security solutions, and customer support services.  In January 2024, a prominent non-profit organization, Water For People, was targeted by the group. The organization faced the pressure of a deadline to comply with the demands of the ransomware group. MEDUSA also targeted four organizations across different countries, including France, Italy, and Spain. The group’s modus operandi remains uniform, with announcements being made on their dark web forum accompanied by deadlines and ransom demands. As organizations deal with the fallout of cyberattacks by groups like MEDUSA, it becomes crucial to remain vigilant and implement stringent security measures. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The United Kingdom and Canada privacy watchdogs announced a joint investigation this week to determine the security lapses in the genetic testing company 23andMe’s October data breach, which leaked ancestry data of 6.9 million individuals worldwide. The UK Information Commissioner John Edwards and Privacy Commissioner of Canada Philippe Dufresne will lead the investigation, pooling the resources and expertise of their respective offices.

Focus of 23andMe Data Breach Investigation

The joint investigation will examine three key aspects:

• Scope of Information Exposed: The breadth of data affected by the breach and the potential harm to individuals arising from it.
• Security Measures: Evaluate whether 23andMe had adequate safeguards to protect the sensitive information under its control.
• Breach Notification: Review whether the company provided timely and adequate notification to the regulators and affected individuals, as mandated by Canadian (PIPEDA) and UK (GDPR) data protection laws.

Edwards said the investigation was needed to garner the trust of people in organizations that handle sensitive personal data. He stated:

“People need to trust that any organization handling their most sensitive personal information has the appropriate security and safeguards in place. This data breach had an international impact, and we look forward to collaborating with our Canadian counterparts to ensure the personal information of people in the UK is protected.”

Dufresne on the other hand stated the risks associated with genetic information in the wrong hands. He said:

“In the wrong hands, an individual’s genetic information could be misused for surveillance or discrimination. Ensuring that personal information is adequately protected against attacks by malicious actors is an important focus for privacy authorities in Canada and around the world.”

The data protection and privacy laws in the UK and Canada allow such joint investigations on matters that impact both jurisdictions. Each regulator will assess compliance with the relevant laws they oversee. Neither of the privacy commissioner offices however provided further details on how they would charge or penalize 23andMe, if found in violation of GDPR or PIPEDA. “No further comment will be made while the investigation is ongoing,” the UK ICO said. 23andMe acknowledges the joint investigation announced by the Privacy Commissioner of Canada and the UK Information Commissioner today.

“We intend to cooperate with these regulators’ reasonable requests relating to the credential stuffing attack discovered in October 2023,” a 23andMe spokesperson told The Cyber Express.

Genetic Testing Company 23andMe Data Breach Timeline

23andMe first disclosed details of the October data breach in an 8-K filing with the U.S. Securities and Exchange Commission. The genetic testing company said attackers scraped profiles of 23andMe users who opted in to using the company’s DNA Relatives feature. This profiling feature connects users with genetic distant relatives - or other 23andMe users who share their bits of DNA. The attackers used credential stuffing attacks that affected 0.1% of user accounts, the company told SEC. Using these accounts as a launchpad, hackers were able to access “a significant number of files containing profile information about other users' ancestry.” Threat actors claimed on underground forums that they were able to siphon “20 million pieces of code” from 23andMe. The claimed data set included information DNA ancestry backgrounds belonging to more than 1.3 million Ashkenazi Jewish and Chinese users. By the end of October, another threat actor claimed compromise of 4 million genetic profiles, which the company also investigated. The genetic testing company 23andMe said it notified the affected 6.9 million users - 5.5 million DNA Relatives profiles and 1.4 million Family Tree profile – in December. The company told federal regulators that the data breach incident was set to incur between $1 million and $2 million in one-time expenses. The company faces at least 30 class action lawsuits in U.S.state and federal jurisdictions as well as in Canada. 23andMe blamed the customers’ poor security hygiene for the breach and has since made two-step verification a prerequisite for account logon. It also mandated customers to reset their passwords. *Update 1 (June 12 – 12:00 AM EST): Added response from the 23andMe spokesperson.

The City of Wichita has made significant progress in recovering from a cyberattack that disrupted many city services early last month. More than a month later, the City of Wichita cyberattack update has come up stating that most public-facing systems are back online, although some services are still being restored. The city reports that water metering, billing, and payment processing systems are gradually coming back online.

City of Wichita Cyberattack Update

Water Services Restored Customers can expect to receive updated statements this week. Auto-payments have resumed normal operations, and customers now have full access to their utility accounts online. Bills can be paid by credit card, cash, check, and money order at City Hall, online at City's payment portal, by calling (316) 265-1300, or through the mail. Due to the cyberattack on City of Wichita, some June bills may cover more than 60 days of service. Customers needing help with these bills are encouraged to contact a representative at (316) 265-1300 to arrange a payment plan. Library Services Update The Wichita Public Library has also seen progress, though some services remain affected. Public Wi-Fi is available at all locations, and patrons can access Libby for eBooks, audiobooks, and digital magazines. Additionally, materials can be checked in and out manually. However, hold requests and renewals, customer account information, the online catalog, the automated materials handler at the Advanced Learning Library, and online databases like Kanopy and LinkedIn Learning are still unavailable. Airport and Court Systems At the Wichita Dwight D. Eisenhower National Airport, public flight and gate display information is not yet available online but is expected to be restored soon. The Municipal Court has made strides in recovery, with most systems operational. The public search of warrants is anticipated to be online by Monday, June 10. The City’s Information Technology team is working to fix the remaining system outages. The city appreciates residents' patience as there may be occasional service interruptions during ongoing recovery efforts.

What Happened During the City of Wichita Cyberattack

The Cyber Express reported that the cyberattack occurred on May 5, leading to the shutdown of several online city services, including water bill payments, some city-building Wi-Fi, and electronic payments. LockBit, a known ransomware group, claimed responsibility for the cyberattack. This followed an earlier notification from the City of Wichita regarding a ransomware incident, although the responsible group was not initially disclosed. The ransomware attack has shown the vulnerabilities in the city's IT systems and the importance of strong cybersecurity measures. Despite the challenges, the city has worked hard to restore essential services to its residents. The City of Wichita urges residents to stay informed through official updates and to reach out to the provided contact points for help. The city remains committed to being transparent and providing the necessary support to its residents during this recovery period.

Findlay Automotive Group, a prominent dealership network with operations spanning Nevada, Utah, Arizona, Washington, and Idaho, recently identified a cybersecurity issue impacting certain areas of its IT infrastructure. Upon discovery, the company swiftly launched an investigation, joining the expertise of leading cybersecurity professionals and collaborating with law enforcement agencies to address the Findlay Automotive cybersecurity issue. While the investigation is ongoing, Findlay Automotive is actively working to mitigate the issue and restore full operational capabilities. However, no details related to the data compromised and the extent of the data breach have been provided by the Officials of Findlay Automotive Group. “Promptly after becoming aware of the issue, we launched an investigation with the assistance of leading cybersecurity experts and law enforcement. Our investigation is ongoing, and we are working diligently to resolve the matter,” reads the company’s statement on Facebook. [caption id="attachment_76709" align="aligncenter" width="760"] Source: Findlay Automotive's Facebook Post[/caption]

Operational Impact of Findlay Automotive Cybersecurity Issue

Despite the restrictions imposed by the Findlay Automotive cybersecurity issue, all dealership locations remain open. Customers with vehicles currently in service are encouraged to visit or contact their respective service departments directly for assistance from Findlay’s dedicated staff. "At Findlay Automotive, we have been serving our communities with pride and integrity since 1961," reads the company’s Facebook Post. "We take our responsibility to our customers and the community very seriously. We will continue to provide updates as the investigation continues and more information becomes available.” The urgency and gravity of the situation are highlighted by recent trends in cybersecurity, particularly the rising threat of ransomware attacks in the industrial sector.

Rising Cyber Threats in the Industrial Sector

In 2019, industrial companies faced significant financial burdens due to ransomware, collectively paying out $6.9 million, which accounted for 62% of the total $11 million spent on ransomware that year. Despite representing only 18% of ransomware cases, the manufacturing sector bore the brunt of the financial impact. By 2020, the cross-industry cost of ransomware had escalated to a staggering $20 billion. Gartner, a research firm, has projected that by 2023, the financial repercussions of cyberattacks on industrial systems, including potential fatal casualties, could exceed $50 billion. The automotive sector, in particular, has become a prime target for cybercriminals. As these threats intensify, paying ransoms become increasingly weak, emphasizing the necessity of enhanced cybersecurity measures to protect assets. The recent Volkswagen incident exemplifies the magnitude of these threats. In April 2024, Volkswagen faced a cyberattack, suspected to originate from Chinese hackers. The breach exposed sensitive data, including development plans for gasoline engines and critical information on e-mobility initiatives. Investigations by ZDF Frontal and “Der Spiegel” revealed more than 40 internal documents, highlighting the severity of the cyberattack. Similarly, in February 2024, Thyssenkrupp's automotive unit in Duisburg, Germany, experienced a cyberattack that disrupted production in its car parts division. Although no data theft or manipulation was detected, the company had to take several systems offline to prevent further unauthorized access, underlining the operational risks posed by such cyber incidents. Closer to home, Eagers Automotive Limited faced a cyber incident on December 27, 2023, leading to a temporary trading halt to address its continuous disclosure obligations. The company issued an apology to its customers for the inconvenience caused by the disruption, reflecting the broad and often immediate impact of cyberattacks on automotive businesses. Findlay Automotive’s proactive response to the current cybersecurity issue demonstrates its commitment to safeguarding its operations and customer trust. The company is maintaining open lines of communication with customers, providing regular updates as the investigation progresses and more information becomes available.

The NoName ransomware group has claimed responsibility for yet another cyberattack targeting government websites in Germany. The proclamation of the attack comes just 11 days after the group is said to have targeted German entities such as Energie Baden-Württemberg AG, Leistritz AG, and Aareal Bank AG. In this latest attack, the group allegedly targeted the Federal Office for Logistics and Mobility and the Federal Ministry of the Interior and Community. NoName allegedly carried out a DDos (Distributed Denial-of-Service) attack, preventing other users from accessing the websites. In the message posted on a dark web forum on Tuesday, NoName claimed that the attack on German websites was to condemn the visit of Ukrainian President Volodymyr Zelenskiy to the country to participate in a conference on Ukraine’s post-war recovery. “Ukrainian President Volodymyr Zelenskyy arrived in Germany late in the evening on Monday, June 10, to take part in an international conference on Ukraine's reconstruction. In his message in Telegram, Zelenskyy said that during his visit he had meetings with German Federal President Frank-Walter Steinmeier, Chancellor Olaf Scholz and Bundestag chairwoman Berbel Bas,” NoName said. “We decided to visit the conference too, and crush some websites,” it added. Despite the hack, NoName has not provided elaborate evidence or context of the cyberattack nor has it provided any details of how the German websites would be affected. While many experts had previously warned people not to underestimate thread actors who take out DDoS attacks, their effectiveness remains a big question, as most of the targets suffer only a few hours of downtime before returning to normal operations. As of the writing of this report, there has been no response from officials of the alleged target websites, leaving the claims unverified.

Previous Instances of NoName Ransomware Attacks

Since first emerging on dark web in March 2022, the pro-Russian hacker group NoName has been increasingly active, shortly after Russia’s invasion of Ukraine. The group has taken responsibility for a series of cyberattacks targeting government agencies, media outlets, and private companies across Ukraine, the United States, and Europe. Before making the claim of targeting German websites, NoName had a history of targeting prominent organizations in other countries. In April 2024, the group allegedly launched a cyberattack on Moldova, affecting key government websites such as the Presidency, Ministry of Foreign Affairs, Ministry of Internal Affairs, and the State Registry. These websites were rendered inaccessible, displaying the message, “This Site Can’t be Reached.” The attack hinted at a politically motivated agenda, though NoName did not explicitly disclose their motives. In March 2024, NoName targeted multiple websites in Denmark, including significant entities like Movia, Din Offentlige Transport, the Ministry of Transport, Copenhagen Airports, and Danish Shipping. Similarly, in January 2024, the group attacked high-profile websites in the Netherlands, including OV-chipkaart, the Municipality of Vlaardingen, the Dutch Tax Office (Belastingdienst), and GVB. More recently, NoName’s cyber onslaught on Finland raised further alarms. Finnish government organizations, including Traficom, the National Cyber Security Centre Finland (NCSC-FI), The Railways, and the Agency for Regulation and Development of Transport and Communications Infrastructure, faced temporary inaccessibility due to DDoS attacks. The ongoing cyberattacks by NoName across several countries serve as a reminder of the perils of the digital landscape. The operations of NoName ransomware, combined with their alleged political motives, highlight the urgent need for enhanced cybersecurity measures and international cooperation. The cybersecurity community must remain vigilant and proactive in protecting digital infrastructure from such malicious actors. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A month after a cyberattack on Ascension, one of the largest nonprofit healthcare systems in the United States, continues to work expeditiously with industry cybersecurity experts to safely restore systems across its network. Ascension Via Christi has announced an update regarding the Ascension cyberattack that it expects to improve efficiencies and reduce wait times for patients. "Please know our hospitals and facilities remain open and are providing patient care. Ascension continues to make progress in our efforts to safely restore systems across our network. Restoring our Electronic Health Record (EHR) system remains a top priority," stated an official Ascension announcement.

Ascension cyberattack: What All Have Restored?

According to the latest update on the Ascension cyberattack, officials have successfully restored EHR access in Florida, Alabama, Tennessee, Maryland, Central Texas (Ascension Seton and Dell Children's hospitals), and Oklahoma markets. Ascension Via Christi further informed that its hospitals, including St. Francis and St. Joseph hospitals, and Ascension Medical Group clinics in Wichita, have restored the primary technology used for electronic patient documentation in care settings. "This will allow most hospital departments, physician offices, and clinics to use electronic documentation and charting. Patients should see improved efficiencies and shorter wait times. Our team continues to work tirelessly to restore other ancillary technology systems," Ascension Via Christi explained on its website, providing cybersecurity updates for its Kansas facilities. [caption id="attachment_76455" align="aligncenter" width="1024"] Source: Ascension Via Christi Website[/caption] The update for Ascension Via Christi St. Francis followed a national update from Ascension, which reported continued progress in restoring systems across its network. The company aims to have systems fully restored across its ministry by Friday, June 14.

Ascension cyberattack: What Happened?

On May 10, The Cyber Express reported that Ascension faced disruptions in clinical operations due to a cyberattack that prompted the organization to take some of its systems offline. Operating in 19 states and the District of Columbia, Ascension oversees 140 hospitals and 40 senior care facilities. It also boasts a significant workforce of 8,500 providers, 35,000 affiliated providers, and 134,000 associates. In 2023, Ascension’s total revenue amounted to $28.3 billion. Given its substantial revenue and widespread operations, the impact of this cyberattack was significant. The organization detected unusual activity on select technology network systems, prompting an immediate response, investigation initiation, and activation of remediation efforts. Consequently, access to certain systems has been interrupted during the ongoing investigation process. Due to the massive cyberattack, Ascension advised its business partners to temporarily sever connections to its systems as a precautionary measure and stated it would notify partners when it is safe to reconnect. The cyberattack on Ascension disrupted clinical operations, prompting an investigation into the extent and duration of the disruption.

In a massive breakthrough, an exclusive news report published by The Cyber Express has led to the arrest of a hacker who threatened to sell sensitive data of 200,000 citizens in Telangana State in India. The Hawk Eye App Data Breach was reported by The Cyber Express on May 31, 2024, which stated how a hacker claimed to reveal personal information of users of Hawk Eye, a popular citizen-friendly app of the Telangana State police. [caption id="attachment_73712" align="alignnone" width="720"] Source: Hawk Eye App on Android[/caption] The Telangana Police further acknowledged that the news report on The Cyber Express gave them crucial leads that led to the arrest of the hacker. In the First Information Report (FIR), a written document prepared by the police in India to detail a cognizable offence, the Telangana Police revealed that it was based exclusively on this report by The Cyber Express, that they were also able to verify the data breach on the Hawk Eye app.

Background of Hawk Eye App Data Breach

The Hawk Eye App was launched by the Telangana Police in December 2014 for both Android and iPhone users as part of its initiative to become a citizen-friendly and responsive police force. Denizens were encouraged to use the app to report on a wide range of activities, including traffic violations, passing on information about criminals, violations by police, and crime against women, and also to pass on suggestions to the lawmen for improved policing and to credit the good work done by them. A key feature of the app is the SOS button for accessing help in case of emergencies. On May 29, 2024, a threat actor, who goes by the name “Adm1nFr1end”, revealed that he had breached the Hawk Eye app. He shared that the stolen database had sensitive data of over 200,000 citizens, including their Personally Identifiable Information (PII), names, email addresses, phone numbers, physical addresses, IMEI numbers, and location coordinates. The threat actor had posted samples of the data breach on hacking website BreachForums and was selling this compromised data for USD $150. [caption id="attachment_73714" align="alignnone" width="1123"] Source: X[/caption]

Arrest of Hawk Eye App Data Breach Hacker

In the aftermath of the news report published on this website, the Telangana Police registered a suo moto case on June 4. “We have registered a case and are investigating the hacking allegations and suspected data breach,” said Telangana Cyber Security Bureau (TGCSB) Director Shikha Goel. On June 9, the Telangana Police reported that its Cyber Security Bureau has apprehended a hacker involved in the Hawk Eye app data breach. “Acting swiftly, the TGCSB investigators travelled to Delhi, where they identified and arrested the hacker, who had claimed to have posted the compromised data on a public platform for a price,” the police said in a statement. Sharing details of the arrest, Director General of Police of Telangana Police, Ravi Gupta, who is the top cop of the state, said that the police had used advanced tools to successfully unveil the hacker's identity. He, however, refrained from elaborating on the techniques used to arrest the hacker to ensure secrecy. “The hacker had posted details of the breach on databreachforum.st, offering the compromised data for sale at $150 USD. He provided the Telegram IDs “Adm1nfr1end” and “Adm1nfr1ends” for interested buyers to contact him regarding the Hawk Eye data,” Ravi said. The alleged hacker was identified as Jatin Kumar, a 20-year-old student and a resident of Greater Noida, a prominent suburb in Delhi's National Capital Region. The police also shared that he was arrested earlier in a case for cybersecurity fraud. (This is Part 1 of the article. Click here to learn more about the hacker, why he was selling the data and how the police tracked him down)

A threat actor known as Desec0x has claimed to possess a database allegedly stolen from the State Grid Corporation of China (SGCC), offering it for sale on the nuovo BreachForums. In the post, Desec0x claimed a cyberattack on SGCC and stated to have gained access through a third-party network, allowing them to exfiltrate sensitive data. The threat actor claimed that multiple databases containing user account information, user details, department information, and roles were accessed. The employee information allegedly includes headers such as eID, username, phone number, email, employee number, username, and password. The database is allegedly available in SQL and XLSX formats for US$1,000.

Potential Implications of Cyberattack on SGCC

Established on December 29, 2002, SGCC is the largest utility company in the world and consistently ranks second on the Fortune Global 500 list. SGCC operates as a group with RMB 536.3 billion in registered capital and employs 1.72 million people. It provides power to over 1.1 billion people across 26 provinces, autonomous regions, and municipalities, covering 88% of China's national territory. Additionally, SGCC owns and operates overseas assets in countries such as the Philippines, Brazil, Portugal, Australia, and Italy. If the claims of the cyberattack on SGCC made by Desec0x are proven to be true, the implications could be far-reaching. The sensitive nature of the data allegedly stolen, including personal and departmental information of SGCC employees, could have serious consequences for the company and its stakeholders. However, upon accessing the official SGCC website, no signs of foul play were detected, and the website appeared to be functioning normally.

Global Context of Cyberattacks in the Energy Sector

The energy sector has been increasingly targeted by cyberattacks, often involving third-party data breaches. According to Security Intelligence, 90% of the world’s top energy companies suffered from third-party data breaches in 2023. Additionally, nearly 60% of cyberattacks in the energy sector are attributed to state-affiliated actors. In late 2023, 22 energy firms were targeted in a large-scale coordinated attack on Danish infrastructure. In April 2024, a group called Cyber Army Russia claimed responsibility for a cyberattack on Consol Energy, a prominent American energy company headquartered in Cecil Township, Pennsylvania. This cyberattack reportedly disrupted the company's website accessibility, causing issues for users outside the United States. In March 2024, a dark web actor was reportedly selling access to an Indonesian energy company, believed to be the same threat actor who targeted an American manufacturer. In 2023, a suspected cyberattack on Petro-Canada was officially confirmed. Suncor Energy, the holding company of Petro-Canada, acknowledged that an IT outage over the weekend was indeed a cyberattack. The company stated that it took immediate action upon discovering the attack, collaborating with third-party experts to investigate and address the situation. This incident caused significant disruptions to Petro-Canada's operations, affecting gas stations and preventing customers from accessing the Petro-Canada app and website. In the case of the State Grid Corporation of China, the claims made by Desec0x remain unverified until an official statement is released by SGCC. Without confirmation from the company, the alleged cyberattack on SGCC and data breach cannot be substantiated. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The popular Japanese video-sharing website Niconico has suspended its services due to a cyberattack, its operator announced. Taking to X, formerly known as Twitter, Niconico tweeted, “As of 10:45 on June 10th, various Niconico services are unavailable. We deeply apologize for the concern and inconvenience this may cause.” In a further update, Niconico informed users, “The cyberattacks are still ongoing, and it is difficult to report on future developments until safety is ensured. We will provide updates to the extent possible this evening.” Details regarding the extent of the data breach and what specific information may have been compromised are still under investigation. [caption id="attachment_76107" align="aligncenter" width="622"] Source: Niconico's X account[/caption] On June 8, the Niconico management team tweeted, “Niconico is currently undergoing a large-scale cyberattack and has temporarily suspended its services in order to minimize the impact.” Despite rapid investigation and countermeasures, they stated, “We cannot begin recovery efforts until we are confident that we have completely eliminated the effects of the cyberattack and ensured safety. There is no hope of recovery at least this weekend.” [caption id="attachment_76108" align="aligncenter" width="637"] Source: Niconico's X account[/caption] Niconico is one of Japan's largest video-sharing platforms, offering a wide variety of content from music and sports to various hobbies. It also features live streaming of programs, including press conferences by government officials. In addition to Niconico, its parent company Kadokawa's official website and its e-commerce site, Ebten, were also affected by possible unauthorized access, the publisher said on Sunday. “We are currently investigating and responding to the issue, and have confirmed that the impact has been felt on the Niconico service in general, the Kadokawa official site, and Ebten. We are also investigating whether any information was leaked,” Kadokawa stated. "We sincerely apologize for causing concern and inconvenience due to the issue affecting several websites of the Kadokawa Group since early Saturday morning," the Tokyo-based publisher added. [caption id="attachment_76111" align="aligncenter" width="699"] Source: Kadokawa's account[/caption]  

How Cyberattack on Niconico Happened

Beginning in the early hours of Saturday, June 8th, an issue arose that prevented access to multiple servers within the group. In response, Kadokawa immediately shut down the relevant servers to protect data. Based on the internal analysis and investigation conducted that same day, it was determined that there was a high possibility of a cyberattack. Kadokawa is investigating the impact of the attack, including "whether there have been leaks of information," and is cooperating with external experts and the police. Niconico, known for its diverse content and live-streaming capabilities, plays a crucial role in the digital landscape of Japan. The suspension of its services has undoubtedly caused widespread concern among its user base, which spans millions of people who rely on the platform for entertainment, information, and community engagement.

Concern Over Niconico Cyberattack

Users have taken to social media to express their support and concern. One user tweeted, “I’ll wait until it’s back. I can’t be of much help, but I’m rooting for you. Niconico saved my life. I can’t imagine life without it.” Another user wrote, “Thank you for your hard work. We will wait patiently, so please don’t push yourself too hard and be patient.” [caption id="attachment_76115" align="aligncenter" width="622"] Source: X[/caption] Some users speculated about the cyberattack on Niconico origins and motives, with one asking, “Do you know who carried out the cyber attack?😓” and another suggesting, “If the attacks are this relentless, it’s almost like they’re testing something...?” [caption id="attachment_76116" align="aligncenter" width="621"] Source: X[/caption] As the investigation of the Niconico cyberattack continues, users and stakeholders await further updates on the situation. The company’s priority remains ensuring the complete elimination of the threat and safeguarding the integrity of its data and services.

Cyber threats continue to evolve this week as attackers target huge ticketing platforms, stealing hundreds of millions of people’s information. Large social media platforms like TikTok were also vulnerable to cyber issues this week. TCE Cyberwatch continues to ensure the highlights of the cybersecurity industry are conveyed to our readers. And remember, vigilance is important. Staying informed on what could affect you as well as knowing of the measures that are being taken is essential.

TCE Cyberwatch: Weekly Round-Up

Free Office Suite Turns Malicious: Pirated Downloads Spreading Malware in South Korea

South Korean researchers have found that pirated copies of productivity software like Microsoft Office and Hangul Word Processor are being used to spread malware. This malware maintains persistence by regularly updating itself, often several times a week. Distributed through file-sharing platforms, these malicious copies appear as cracked installers. Attackers use Telegram or Mastodon channels to provide encrypted instructions leading to malicious payloads hosted on Google Drive or GitHub. The malware includes strains like OrcusRAT, XMRig Cryptominer, 3Proxy, and PureCrypter, which perform various malicious activities, including keylogging, cryptomining, and disabling security products. The malware's ability to update and re-infect systems makes it difficult to remove. Researchers urge users to download software from official sources and update antivirus programs to prevent infection. Read More

Spanish Police Bust Illegal Streaming Network Serving 14,000 Subscribers

Spanish police dismantled an illegal media distribution network that had generated over 5.3 million euros since 2015. The operation began in November 2022 after a complaint from the Alliance for Creativity and Entertainment (ACE), targeting the IPTV service ‘TVMucho’ (also known as ‘Teeveeing’). TVMucho/Teeveeing, with over 4 million visits in 2023, offered over 125 channels, including BBC and ITV. Eight individuals were arrested across various cities, and authorities seized a vehicle, and computers, and froze 80,000 euros in bank accounts. Sixteen related websites were blocked. The network, led by Dutch nationals, decrypted and distributed content from over 130 channels. The crackdown disrupted a service with 14,000 subscribers, causing significant financial damage to content creators. Read More

Millions at Risk: Ticketmaster Confirms Huge Data Breach

Live Nation, Ticketmaster's parent company, confirmed a data breach after hackers claimed to have stolen personal details of 560 million customers. The breach was disclosed in a U.S. Securities and Exchange Commission (SEC) filing. Live Nation detected unauthorized activity in a third-party cloud database on May 20, 2024, and began an investigation. The company is mitigating risks, notifying affected users and regulatory authorities, and cooperating with law enforcement. The stolen data was hosted on Snowflake, a cloud storage firm. Snowflake and cybersecurity firms CrowdStrike and Mandiant are investigating, attributing the breach to identity-based attacks exploiting compromised user credentials. Recommendations include enforcing multi-factor authentication and resetting credentials. Live Nation asserts the breach has not significantly impacted its business operations. Read More

COVID Relief Fraud Busted: $5.9 Billion Botnet Scheme Unraveled

The DOJ charged Chinese national YunHe Wang with operating the "world's largest botnet," which stole $5.9 billion in Covid relief funds. Wang allegedly used the 911 S5 botnet to hack over 19 million IP addresses in nearly 200 countries from 2014 to 2022. The botnet also engaged in other crimes like fraud and harassment. Wang, who profited at least $99 million, faces up to 65 years in prison. The DOJ, FBI, and international law enforcement dismantled the network and arrested Wang. The U.S. has been increasingly concerned about sophisticated cyber threats, particularly from China. In January, the FBI dismantled another Chinese hacking group targeting U.S. infrastructure. Wang's arrest follows Treasury Department sanctions on him and his associated companies. Read More 

Poland Boosts Cybersecurity with $760 Million Investment After Suspected Russian Attack

Poland will invest over 3 billion zlotys ($760 million) to enhance cybersecurity following a likely Russian cyberattack on state news agency PAP. With European Parliament elections imminent, Poland is vigilant against Moscow's interference, especially after a false military mobilization article appeared on PAP. Poland, a key supporter of Ukraine, frequently accuses Russia of destabilization attempts, claims Russia denies. Digitalization Minister Krzysztof Gawkowski announced the "Cyber Shield" initiative and highlighted Poland's frontline position in the cyber conflict with Russia. Recent cyberattacks on critical infrastructure were blocked, reinforcing concerns about Russia's intent to destabilize and benefit anti-EU forces. Poland has linked Russia to sabotage and espionage activities, prompting the re-establishment of a commission to investigate Russian influence. Read More

Russia Accused of Spreading Misinformation Ahead of European Parliament Elections

European governments accuse Russia of spreading misinformation ahead of the European Parliament elections from June 6-9. Alleged tactics include amplifying conspiracy theories, creating deepfake videos, and cloning legitimate websites to disseminate false information. The Czech Republic identified a pro-Russian influence operation led by Viktor Medvedchuk, while Belgium accused Russian officials of bribing EU lawmakers to promote propaganda. Russia denies these accusations, claiming the West is waging an information war against it. European leaders, like Ursula von der Leyen, stress the importance of resisting authoritarian influence. The EU's Digital Services Act mandates the removal of illegal content and transparency in content aggregation. Tech giants like Meta, Google, and TikTok are implementing measures to counter election-related disinformation. Read More

Deepfakes Target Businesses: $25 Million Scam Exposes AI's Dark Side

Deepfake scams are increasingly targeting companies worldwide, exploiting generative AI for fraud. In a major case, a Hong Kong finance worker was deceived into transferring over $25 million to fraudsters using deepfake technology to pose as colleagues. UK engineering firm Arup confirmed involvement in this case, emphasizing a rise in such sophisticated attacks. OpenAI’s ChatGPT has popularized generative AI, lowering the barrier for cybercriminals. AI services can generate realistic text, images, and videos, aiding illicit activities. Deepfake incidents have targeted financial employees, leading to substantial financial losses. Companies fear deepfakes could manipulate stock prices, defame brands, and spread misinformation. Cybersecurity experts recommend enhanced staff education, testing, and multi-layered transaction approvals to mitigate risks, stressing that cybercrime will likely escalate before effective defences are developed. Read More

Up to 7 Years Jail for Deepfake Porn in Australia: New Laws Crack Down on Online Abuse

Proposed new Australian laws will impose up to six years in jail for sharing non-consensual deepfake pornographic images, and seven years for creating them. Attorney General Mark Dreyfus will introduce the legislation to make it illegal to share these images via any platform. Dreyfus condemned the harmful nature of such material, which predominantly affects women and girls. The laws aim to update legal protections in line with technological advances. Currently, creating such images isn't illegal under federal law, but the new bill expands existing laws on using technology to commit crimes. The legislation also seeks to curb technology-facilitated abuse and will include measures addressing doxing and reviewing the Online Safety Act. These changes are part of efforts to combat violence against women. Read More

Zero-Click Hack Hits TikTok: High-Profile Accounts Hijacked

Recently, hackers exploited a zero-day vulnerability in TikTok’s direct messaging feature to take over high-profile accounts without victims needing to download anything or click links. This flaw, unknown to the software makers, allowed control of accounts belonging to CNN, Sony, and Paris Hilton. TikTok's security lead, Alex Haurek, stated that they are working to prevent future attacks and restore affected accounts. Although only a few accounts were compromised, TikTok has not specified the numbers. Read More

Wrap Up

This week has shown the multiple vulnerabilities in even the biggest and assumed to be highly protected companies. Like always, there are tensions surrounding cyber issues in the world of politics as well. We over here at TCE hope that our readers know of the measures to be taken if ever affected by these breaches or hacks, as well as knowing the signs to look out for so as to not fall victim to cyberattacks. We are happy to see nations investing in the betterment of cyber security for their people.

A major French telecommunications company, Corse GSM, has allegedly been hit by a massive data breach. It could have a potential impact on millions of its customers. The Corse GSM data breach claims was made by a threat actor, using the alias "ssh_xyz," on popular data hack site BreachForums. In the post, the threat actor claimed to have stolen a massive amount of data containing information on 200,000 users of the telecom company. The hacker claimed that the data was exfiltrated between May 3 and May 25, 2024. To support these claims, the TA included a sample of the data in JSON format, a common method for storing and transmitting data between servers and web applications.

Exploring the Corse GSM Data Breach

The threat actor provided a detailed sample dataset that provided a look into the kind of information that may have been compromised in the breach. The leaked data consists of: User Identification: This covers fields like ID and possibly other unique markers used by Corse GSM for tracking purposes. Personal Details: The breach reportedly involves customer information such as name, last name and phone number. Contact Info: It is said that hackers have also accessed customer email addresses. This raises concerns about targeted phishing attempts. Subscription Information: This may encompass subscription plans, internet packages, and other services subscribed to by customers of Corse GSM. Financial Information: The TA had shared details about the presence of fields like BIC (Business Identifier Code), IBAN (International Bank Account Number), and KYC (Know Your Customer) data. If the above information is true, then it could possibly leverage the risk of financial fraud or identity theft. Blacklist Status: If this data field is included in the leak, it might expose details of a customer who could be blacklisted by Corse GSM for reasons like missed payments or service violations.

Corse GSM Hacker Claims Possession of Financial Details of Customers

If the sample above seems like a precarious scenario for the privacy of customers, the hacker further alleged that the entire leaked database contains a much broader range of information, including: National Identity Card (CNI) Details: CNI or France’s National Identity Card details allegedly leaked by the threat actor could put citizens at huge security risk. The CNI contains fingerprint details, which is a major security breach if the corresponding data is compromised. SEPA Information: Single Euro Payments Area or SEPA data could include bank account details critical for financial transactions. The threat actor is seeking substantial sums for the database on the dark web, suggesting that the hacker believes the information holds significant value for malicious actors.

Corse GSM Yet to React to Data Breach Claims

Corse GSM has not reacted or issued any official statement regarding the alleged data breach. This article will be updated once the company responds to the allegations and takes action to prevent crucial data from being misused. Meanwhile, customers can take preventive steps like changing passwords and login credentials of accounts linked to Corse GSM. They should also be wary and not fall victim to phishing attempts. Fraudsters could use the leaked email addresses to send fraudulent links. They should also monitor their bank accounts linked to the subscription of Corse GSM mobile plans. They should also relay information of any suspicious activity to law enforcement authorities. The potential data breach at Corse GSM highlights the ever-present threat of cyberattacks and the importance of robust data security practices. Telecommunications companies handle a vast amount of sensitive customer information, making them prime targets for hackers. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Guardian Analytics Inc. and Webster Bank N.A. have agreed to pay over $1.4 million to resolve claims stemming from a data breach in 2022. The Guardian Analytics and Webster Bank data breach compromised the personal information of approximately 192,000 individuals, leading to allegations of inadequate protection of sensitive customer data. The settlement, which received final approval in federal court, addresses grievances brought forward in a consolidated class action lawsuit. Plaintiffs contended that both Guardian Analytics, a provider of data analytics services to financial institutions, and Webster Bank, failed to implement sufficient measures to safeguard sensitive customer information, including names, Social Security numbers, and financial account details.

Going Back to Guardian Analytics and Webster Bank Data Breach

During the Guardian Analytics data breach, unauthorized individuals gained access to Guardian's network systems between November 27, 2022, and January 26, 2023, obtaining the personally identifiable information (PII) of plaintiffs and class members. This data breach left affected individuals vulnerable to identity theft and other forms of fraud. The plaintiffs alleged that the defendants, Guardian Analytics and Webster Bank, breached their duty to implement and maintain adequate security measures, thereby allowing the breach to occur. As a result, plaintiffs and class members suffered various damages, including a significant risk of identity theft, loss of confidentiality of their PII, and financial losses due to inadequate data security measures.

The $1.4 Million Data Breach Lawsuit

The Guardian Analytics and Webster Bank data breach settlement agreement includes provisions to reimburse affected individuals for monetary losses, covering up to $5,000 for direct financial losses and up to $250 for ordinary losses. Additionally, the agreement compensates for four hours of lost time incurred by plaintiffs dealing with the aftermath of the breach. Individual plaintiffs, including Mark S. Holden, Richard Andisio, Edward Marshall, Ann Marie Marshall, Arthur Christiani, Johnielle Dwyer, Pawel Krzykowski, and Mariola Krzynowek, represented the class action lawsuit. Each plaintiff cited damages suffered as a result of the breach, ranging from financial losses to significant time spent rectifying the situation and monitoring accounts for fraudulent activity. The settlement serves as a reminder of the importance of robust data security measures in an era where cyber threats are increasingly prevalent. Both Guardian Analytics and Webster Bank have emphasized their commitment to enhancing security protocols to prevent similar incidents in the future. The legal proceedings shed light on the grave consequences of data breaches, including prolonged periods of identity theft resolution and financial instability for affected individuals. As technology continues to evolve, businesses must prioritize cybersecurity to protect customer data and maintain trust in an increasingly digital world.

A threat actor (TA) has posted databases belonging to two prominent companies utilizing blockchain technology, The DFINITY Foundation and Cryptonary, on the Russian-language forum Exploit. The databases, if genuine, contain sensitive information of hundreds of thousands of users, allegedly exposing them to significant security risks. The threat actor's post on Exploit detailed the alleged data breaches at DFINITY and Cryptonary.

Details of Alleged Data Breaches at DFINITY and Cryptonary

For The DFINITY Foundation, the threat actor claimed to have over 246,000 user records with information fields including:

• Email Address
• First Name
• Last Name
• Birthday
• Member Rating
• Opt-in Time and IP
• Confirm Time and IP
• Latitude and Longitude
• Timezone, GMT offset, DST offset
• Country Code, Region
• Last Changed Date
• Leid, EUID
• Notes

For Cryptonary, the post advertised 103,000 user records containing:

• Email
• First Name
• Last Name
• Organization
• Title
• Phone Number
• Address
• City, State/Region, Country, Zip Code
• Historic Number of Orders
• Average Order Value
• User Topics

The prices quoted for these datasets were $9,500 for DFINITY's data and $3,500 for Cryptonary's data. The DFINITY Foundation is a Swiss-based not-for-profit organization known for its innovative approach to blockchain technology. It operates a web-speed, internet-scale public platform that enables smart contracts to serve interactive web content directly into browsers. This platform supports the development of decentralized applications (dapps), decentralized finance (DeFi) projects, open internet services, and enterprise systems capable of operating at hyper-scale. On the other hand, Cryptonary is a leading platform in the crypto tools and research space. It provides essential insights and analysis to help users navigate the complexities of the cryptocurrency market and capitalize on emerging opportunities. When The Cyber Express Team accessed the official website of The DFINITY Foundation, they found a message warning visitors about phishing scams on third-party job boards. The message read: “Recently, we've seen a marked increase in phishing scams on third-party job boards — where an individual impersonating a DFINITY team member persuades job-seekers to send confidential information and/or payment. As good practice, please continue to be vigilant regarding fraudulent messages or fake accounts impersonating DFINITY employees. If you need to confirm the legitimacy of a position, please reach out to recruiting@dfinity.org.” [caption id="attachment_75612" align="aligncenter" width="1024"] Source: Offical Website of The DFINITY Foundation[/caption] While this message serves as a caution regarding phishing scams, it is unclear whether it hints at a broader security issue or is merely a general warning. The DFINITY website and the Cryptonary website both appeared fully functional with no evident signs of compromise. The Cyber Express Team reached out to the officials of both companies for verification of the breach claims. However, as of the time of writing, no official response had been received, leaving the authenticity of the threat actor's claims unverified. Now whether this message is a hint that they are being attacked by a criminal or it's just a caution message, we can come to the conclusion they release any official statement regarding the same.

Implication of Cyberattack on Blockchain Technology

However, if the claims of the data breaches are proven true, the implications could be far-reaching for both The DFINITY Foundation and Cryptonary. The exposure of sensitive user data could lead to: Identity Theft and Fraud: Users whose personal information has been compromised could become victims of identity theft and fraud, leading to financial and personal repercussions. Reputational Damage: Both companies could suffer significant reputational harm. Trust is a critical component in the blockchain and cryptocurrency sectors, and a data breach could erode user confidence in their platforms. Legal and Regulatory Consequences: Depending on the jurisdictions affected, both companies might face legal actions and regulatory fines for failing to protect user data adequately. Operational Disruptions: Addressing the breach and enhancing security measures could divert resources and attention from other business operations, impacting overall performance and growth. While the claims remain unverified, the potential consequences highlight the importance of vigilance and proactive security strategies. The Cyber Express Team will continue to monitor the situation and provide updates as more information becomes available. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Senator Ron Wyden (D-Ore.) is pressing the U.S. government to accelerate cybersecurity enhancements within the healthcare sector following the devastating Change Healthcare ransomware attack that exposed the protected health information of nearly a third of Americans. In a letter to Xavier Becerra, secretary of the U.S. Department of Health and Human Services, Wyden urged HHS to implement immediate, enforceable steps to improve “lax cybersecurity practices” of large healthcare organizations.

“It is clear that HHS’ current approach to healthcare cybersecurity — self-regulation and voluntary best practices — is woefully inadequate and has left the health care system vulnerable to criminals and foreign government hackers.” - Wyden.

He stated that the sub-par cybersecurity standards have allowed hackers to steal patient information and disrupt healthcare services, which has caused “actual harm to patient health.”

MFA Could Have Stopped Change Healthcare Attack

The call from Wyden comes on the back of the ransomware attack on Change Healthcare — a subsidiary of UnitedHealth Group — which, according to its Chief Executive Officer Andrew Witty, could have been prevented with the basic cybersecurity measure of Multi-Factor Authentication (MFA). The lack of MFA on a Citrix remote access portal account that Change Healthcare used proved to be a key vulnerability that allowed attackers to gain initial access using compromised credentials, Witty told the Senate Committee on Finance in a May 1 hearing.

“HHS’ failure to regulate the cybersecurity practices of major health care providers like UHG resulted in what the American Hospital Association has described as the worst cyberattack against the healthcare sector in U.S. history.” - Wyden

The use of MFA is a fundamental cybersecurity practice that HHS should mandate for all healthcare organizations, Wyden argued. He called for the implementation of broader minimum and mandatory technical cybersecurity standards, particularly for critical infrastructure entities that are designated as "systemically important entities" (SIE) by the U.S. Cybersecurity and Infrastructure Security Agency. “These technical standards should address how organizations protect electronic information and ensure the healthcare system’s resiliency by maintaining critical functions, including access to medical records and the provision of medical care,” Wyden noted. He suggested that HHS enforce these standards by requiring Medicare program participants to comply.

Wyden’s Proposed Cybersecurity Measures for HHS

Wyden said HHS should mandate a range of cybersecurity measures as a result of the attack. “HHS must follow the lead of other federal regulators in mandating cybersecurity best practices necessary to protect the healthcare sector from further, devastating, easily-preventable cyberattacks,” Wyden argued. The Democratic senator proposed several measures to enhance cybersecurity in the healthcare sector, including:

• Mandatory Minimum Standards: Establish mandatory cybersecurity standards, including MFA, for critical healthcare infrastructure.
• Rapid Recovery Capabilities: Ensure that organizations can rebuild their IT infrastructure within 48 to 72 hours following an attack.
• Regular Audits: Conduct regular audits of healthcare organizations to assess and improve their cybersecurity practices.
• Technical Assistance: Provide technical security support to healthcare providers.

Wyden criticized HHS for its current insufficient regulatory oversight, which he believes contributes to the ongoing cyberattacks harming patients and national security. “The current epidemic of successful cyberattacks against the health care sector is a direct result of HHS’s failure to appropriately regulate and oversee this industry, harming patients, providers, and our national security,” Wyden said. He urged HHS to use all of its authorities to protect U.S. healthcare providers and patients from mounting cybersecurity risks.

The State of Ransomware in Healthcare

The healthcare sector was the most common ransomware target among all critical infrastructure sectors, according to FBI’s Internet Crime Report 2023. The number of attacks and individuals impacted have grown exponentially over the last three years. [caption id="attachment_75474" align="aligncenter" width="1024"] Ransomware attacks on healthcare in last three years. (Source: Emsisoft)[/caption]

“In 2023, 46 hospital systems with a total of 141 hospitals were impacted by ransomware, and at least 32 of the 46 had information, including protected health information, stolen.” - Emsisoft

A study from McGlave, Neprash, and Nikpay from the University of Minnesota School of Public Health found that in a five-year period starting in 2016, ransomware attacks likely killed between 42 and 67 Medicare patients. Their study further observed a decrease in hospital volume and services by 17-25% during the week following a ransomware attack that not only hit revenue but also increased in-hospital mortality among patients who were already admitted at the time of attack.

HHS Cybersecurity Response

HHS announced in December plans to update its cybersecurity regulations for the healthcare sector for the first time in 21 years. These updates would include voluntary cybersecurity performance goals and efforts to improve accountability and coordination. The Healthcare and Public Health Sector Coordinating Council also unveiled a five-year Health Industry Cybersecurity Strategic Plan in April, which recommends 10 cybersecurity goals to be implemented by 2029. Wyden acknowledged and credited the latest reform initiatives from HHS and the HSCC, but remains concerned about the lengthy implementation timeline, which he said requires urgency when it comes to the healthcare sector. The latest letter follows Wyden’s request last week to the SEC and FTC to investigate for any negligence in cybersecurity practices of UnitedHealth Group. HHS is currently investigating the potential UHG breach that resulted in the exposure of protected health information of hundreds of thousands of Americans.

The Akira ransomware group allegedly targeted E-T-A Elektrotechnische Apparate GmbH, an organization located in Germany. The ransomware group claims to have stolen 24 gigabytes of sensitive material, including customer information, non-disclosure agreements (NDAs), financial records, and employee personal information. To substantiate these claims, the threat actor has attached a screenshot with all this information. E-T-A Elektrotechnische Apparate GmbH operates six production facilities and has a presence in 60 countries worldwide. The company’s product range includes a variety of electrical protection solutions essential to numerous industries. The company is renowned for manufacturing circuit breakers, electronic circuit protectors, and various other electronic components. Despite the ransomware group's claims, the company's official website appeared to be fully functional, and there were no signs of foul play. Further to verify Akira's cyberattack on E-T-A claims, The Cyber Express Team reached out to E-T-A Elektrotechnische Apparate GmbH for an official statement. As of the time of writing, no response has been received from the company. This leaves the ransomware claims unverified, with no confirmation or denial from E-T-A's officials.

Akira Ransomware: Previous Track Record

The Akira ransomware gang has arisen as a danger to small and medium-sized organizations (SMBs), mostly in Europe, North America, and Australia. The group uses advanced tactics to infiltrate systems, frequently acquiring illegal access to a company's virtual private networks (VPNs). Sophos X-Ops research shows that Akira often uses compromised login credentials or exploits weaknesses in VPN technologies such as Cisco ASA SSL VPN or Cisco AnyConnect. Recently, in May 2024, Akira targeted Western Dovetail, a well-known woodworking shop. In April 2024, Akira was identified as the gang responsible for a series of cyberattacks against businesses and key infrastructure in North America, Europe, and Australia. According to the US Federal Bureau of Investigation (FBI), Akira has hacked over 250 firms since March 2023, collecting roughly $42 million in ransom payments. Initially, Akira's attacks targeted Windows systems. However, the gang has since broadened its tactics to include Linux computers, causing anxiety among international cybersecurity agencies. These cyberattacks show Akira's strategy of targeting a wide range of industries and businesses of all sizes, frequently resulting in major operational interruptions and financial losses. As it stands, the Akira ransomware group's claims against E-T-A Cyberattack are unsubstantiated. The lack of an official response from the company creates a vacuum in the confirmation of these claims. While the company's website is still operational, signaling no immediate disruption, a data breach might have serious consequences, compromising client confidentiality, financial integrity, and employee privacy. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Advance Auto Parts, Inc., a significant provider of automobile aftermarket components, has allegedly suffered a massive data breach. A threat actor going by the handle "Sp1d3r" claimed Advance Auto Parts data breach. The threat actor further claims to have stolen three terabytes of data from the company's Snowflake cloud storage. The stolen information is allegedly being sold for US$1.5 million. According to the threat actor, Sp1d3r, post the stolen data includes:

• 380 million customer profiles, containing names, emails, mobile numbers, phone numbers, addresses, and more.
• 44 million Loyalty/Gas card numbers, along with customer details.
• Information on 358,000 employees, though the company currently employs around 68,000 people. This discrepancy suggests the data might include records of former employees.
• Auto parts and part numbers.
• 140 million customer orders.
• Sales history
• Employment candidate information, including Social Security numbers, driver's license numbers, and demographic details.
• Transaction tender details.
• Over 200 tables of various data.

The threat actor has specified that a middleman is required to facilitate the sale of the stolen data, and no dealings will be conducted via Telegram. Furthermore, what’s worth noting is that in its post, the threat actor claimed to sell the stolen information of 358,000 employees, despite the fact that the organization now employs approximately 68,000 people. The disparity could be due to old data from former employees and associates. [caption id="attachment_75319" align="aligncenter" width="815"] Source: X[/caption] [caption id="attachment_75320" align="aligncenter" width="346"] Source: X[/caption] To find answers to these doubts and verify the threat actor's claims, The Cyber Express Team reached out to the officials to verify the breach, however, as of writing this news report no response has been received. Therefore, the confirmation or denial of these claims has yet to be verified. Advance Auto Parts operates 4,777 stores and 320 Worldpac branches primarily within the United States, with additional locations in Canada, Puerto Rico, and the U.S. Virgin Islands. The company also serves 1,152 independently owned Carquest branded stores across these locations, as well as in Mexico and various Caribbean islands.

Advance Auto Parts Data Breach: Linked to Snowflake Cyberattacks

The Advance Auto Parts data breach is part of a recent series of attacks targeting customers of Snowflake, a cloud storage company. These attacks have been ongoing since at least mid-April 2024. Snowflake acknowledged the issue in a statement, informing a limited number of customers who they believe may have been impacted by the attacks. However, Snowflake did not provide specific details about the nature of the cyberattacks or confirm if data had been stolen from customer accounts. This incident follows another significant breach involving Live Nation, the parent company of Ticketmaster. Hackers claimed to have stolen personal details of 560 million customers, and the stolen data was hosted on Snowflake's cloud storage. Live Nation disclosed this breach in a filing to the U.S. Securities and Exchange Commission (SEC), revealing that a criminal actor had offered the company's user data for sale on the dark web. In response to the breach, Snowflake and third-party cybersecurity experts, CrowdStrike and Mandiant, issued a joint statement regarding their ongoing investigation into the targeted threat campaign against some Snowflake customer accounts. They are working diligently to understand the extent of the breach and mitigate its impact. Screenshots shared by the threat actor indicate that the leaked data contains numerous references to 'SNOWFLAKE,' supporting the claim that it was stolen during the recent Snowflake data theft attacks. The full extent of the data breach and its implications for Advance Auto Parts and other companies using Snowflake remains to be seen. With Snowflake's large client base and the significant volume of data they manage, the repercussions could be widespread. Only time will tell how many more companies will disclose their data breaches linked to the recent Snowflake attacks. In the meantime, affected customers and employees are advised to monitor their personal information closely and take necessary precautions to protect their data. Companies utilizing Snowflake's services should stay vigilant and follow cybersecurity best practices to safeguard their data against potential threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The American Radio Relay League (ARRL), the national body for amateur radio in the United States, has provided additional information concerning the May 2024 cyber incident. The ARRL cyberattack pulled its Logbook of the World (LoTW) down, leaving many members upset with the organization's perceived lack of information. According to the latest update from ARRL, on or around May 12, 2024, the company experienced a network attack by a malicious international cyber group. Upon discovering the ARRL cyberattack, the organization immediately involved the FBI and joined third-party experts to assist with the investigation and remediation efforts. The FBI categorized the ARRL cyberattack as "unique," due to its nature, compromising network devices, servers, cloud-based systems, and PCs. ARRL's management quickly set up an incident response team to contain the damage, restore servers, and test applications to ensure proper operation. In a statement, ARRL emphasized its commitment to resolving the issue: "Thank you for your patience and understanding as our staff continue to work through this with an outstanding team of experts to restore full functionality to our systems and services. We will continue to update members as advised and to the extent we are able."

ARRL Cyberattack: Lack of Information

Despite ARRL's efforts, many members felt that the company was not forthcoming enough with information. A Facebook user posted a lengthy note criticizing ARRL's communication strategy. The Facebook user post read, "We still don’t know what they haven’t told us and maybe it is important, maybe not. The point is very clear that the communication to the membership about the incident is very unprofessional and limited in its scope. Nobody needed critical details, they needed to be treated like they are members of an organization, not subjects to the king." [caption id="attachment_74996" align="aligncenter" width="1015"] Source: Facebook[/caption] The Facebook user pointed out several gaps in ARRL cyberattack updates, such as the absence of information about the phone systems being down and the lack of a communication path for interim assistance.

Timeline of ARRL Cyberattack Updates and Service Restoration

May 17, 2024: ARRL assured members that their personal information, such as credit card numbers and social security numbers, was not stored on their systems. The organization only holds publicly available information like names, addresses, and call signs. However, there was still no mention of the phone systems being down or alternative communication paths for assistance. May 22, 2024: ARRL provided an update stating that the LoTW data was secure and not affected by the server issue. They also mentioned the upcoming July issue of QST magazine, which would be delayed for print subscribers but on time digitally. Yet again, there was no mention of the phone systems or email service disruptions. May 29, 2024: The ARRL Volunteer Examiner Coordinator resumed processing Amateur Radio License applications with the FCC. Voice bulletins at W1AW, the Hiram Percy Maxim Memorial Station, also resumed. ARRL's store orders resumed shipping, and the e-newsletter services were back online. Finally, the organization acknowledged the phone system outage. May 31, 2024: ARRL announced that their phone system was back in service, and provided contact information for members. They also shared details about upcoming contests and magazine issues, including limited functionality of the Contest Portal. Members were reminded that they could renew their memberships online or by phone.

Ongoing Communication Issues

Despite these updates on ARRL cyberattack, members continued to express dissatisfaction with ARRL's handling of the situation. The Facebook post that critiqued ARRL's communication was particularly poignant, summarizing the frustration felt by many. While ARRL has taken significant steps to address the data breach and reassure its members, there is a clear need for more consistent and detailed communication moving forward.

The Australian privacy watchdog on Wednesday filed a lawsuit against Medibank, the country's largest private health insurer, for failing to protect its 9.7 million customers' personal information in a 2022 data breach incident.

The Australian Information Commissioner said in a civil penalty proceedings filed in the Federal Court that Medibank "seriously interfered" with the privacy of Australians by failing to take reasonable steps to protect their data from misuse and unauthorized access. These issues are allegedly in breach of the country's Privacy Act 1988, according to the OAIC.

A threat actor known as Sanggiero has claimed responsibility for a data breach affecting the UK-based e-commerce platform PandaBuy. The threat actor, who operates on BreachForums, posted an advertisement offering more than 17 million user records for sale. The announcement of PandaBuy data breach comes after Sanggiero partially shared PandaBuy's data on March 31, 2024. PandaBuy, a Chinese online marketplace known for selling counterfeit products, has over one million downloads on Google Play Store and 2.95k reviews. According to the TA's post on the breach fourm, the compromised data includes first name, last name, user ID, email address, order data, order ID, login IP address, country, name of the employee, and hashed password. To prove the authenticity of the breach, Sanggiero shared a screenshot of the compromised JSON file and the total number of records. The hacker claims the data was obtained by exploiting critical vulnerabilities in PandaBuy’s platform and plans to publicly disclose these weaknesses on their blog soon. I would also explain on my blog all the vulnerabilities which have not yet been fixed by PandaBuy," the hacker stated.

PandaBuy Data Breach: Threat Actor Set a Price Tag

Sanggiero is offering the complete database for a price of $40,000. The hacker's post read, “We sell the whole database of PandaBuy. Indeed, you will have seen a few months ago we partially disclosed PandaBuy data. Now we sell all of the data that include 17 millions of lines on users for a price of $40,000.” In addition to the ransom, Sanggiero warned of disclosing the names of PandaBuy employees along with their passwords, which are encoded in base-64. The post also left an open invitation for PandaBuy to resume negotiations to prevent further disclosures. “The names of the employees will also be disclosed with their passwords (encoded in base-64). If PandaBuy wants to resume negotiations, they are welcome. No more time to waste.”

PandaBuy Legal Troubles

This data breach adds to the growing list of troubles for PandaBuy. In April 2024, Chinese authorities targeted the platform for supplying counterfeit goods. Police raided its warehouses, which held millions of packages destined for overseas buyers. The crackdown involved more than 200 public security branch officers, 50 private sector investigators, and local police. The raids led to the detention of over 30 people and the seizure of millions of parcels, including hundreds of thousands of fake branded sports shoes. Prior to this, PandaBuy faced legal action from 16 brands over copyright infringement. The Hangzhou office and several warehouses of PandaBuy were raided, resulting in significant legal and reputational challenges for the company. The investigation, first publicized by World Trademark Review, was carried out in cooperation with the City of London police and several intellectual property protection firms, including Corsearch, Rouse, and Rouse’s China-based strategic partner Lusheng Law Firm.

What This Means for PandaBuy Users

For PandaBuy users, this alleged data breach is a serious concern. The compromised data includes sensitive personal information that could be used for identity theft, phishing attacks, and other malicious activities. Users are advised to:

• Change their PandaBuy passwords immediately.
• Monitor their email accounts for suspicious activity.
• Be wary of phishing emails or messages that may try to exploit the stolen data.

Additionally, PandaBuy users should consider using two-factor authentication (2FA) for their accounts to add an extra layer of security.

Looking Ahead

For PandaBuy, the road to recovery will be challenging. The company not only needs to address the security flaws that led to the alleged PandaBuy data breach but also rebuild trust with its users and partners. The ongoing legal battles over counterfeit goods add another layer of complexity to their situation. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Australian Treasurer Jim Chalmers has mandated that several Chinese-linked investors divest their shares in Northern Minerals, a rare earth miner. The directive, grounded in foreign investment laws, requires the sale of these stakes due to concerns over national security linked to a Northern Minerals cyberattack incident. The move comes at a time when the mining sector is increasingly seen as strategic, particularly in light of recent developments surrounding the Browns Range heavy rare earths project in Western Australia. Northern Minerals is at the forefront of developing this crucial project, which has gained attention for its potential role in green energy and defense sectors. The Browns Range mine is positioned to be a supplier for Iluka Resources' Eneabba rare earth refinery, a project backed by substantial Australian government funding.  However, the spotlight on Northern Minerals has also made it a target for cyberattacks, which has now gained urgency following a data breach made by the BianLian ransomware group.

Decoding the Northern Minerals Cyberattack Claims

[caption id="attachment_74717" align="alignnone" width="765"] Source: Dark Web[/caption] The cyberattack on Northern Minerals has raised questions not only for the organization but also for stakeholders and investors, as many businesses and individuals have invested heavily in these mining projects. Prior to the current situation, Northern Minerals discovered a data breach incident in late March that compromised a range of sensitive data, including corporate, operational, and financial information, as well as details about current and former personnel and shareholders. Despite the severity of the breach, Northern Minerals reported that its operations and broader systems remained largely unaffected. However, the BianLian group has leaked data it says was compromised in the attack, including operational, strategic, R&D, financial, and employee information, along with executive emails and phone numbers. Treasurer Jim Chalmers' directive to Chinese-linked investors, including Yuxiao Fund, to sell their stakes in Northern Minerals is a significant move to safeguard Australia's national interests. The Foreign Investment Review Board advised this action to ensure compliance with Australia's foreign investment framework. The decision affects not only Yuxiao Fund but also other foreign shareholders, who have been given 60 days to dispose of their shares. Yuxiao Fund, a Singapore-registered private investment vehicle of Chinese national Wu Yuxiao, had previously been restricted from increasing its stake in Northern Minerals. The Australian government's insistence on these divestitures reflects a broader strategy to reduce dependency on foreign entities, particularly those linked to China, in the critical minerals sector.

Strategic Implications of the Cyberattack on the Mining Industry

The cyberattack on Northern Minerals highlights the broader vulnerabilities within the critically important mining industry, which is becoming an increasingly attractive target for cybercriminals. The attack on Northern Minerals, along with similar incidents like one involving Rio Tinto in 2023, illustrates the critical need for enhanced cybersecurity protocols across the sector. These attacks not only threaten the operational integrity of mining companies but also pose significant risks to national security, given the strategic importance of rare earth elements. As the mining sector becomes increasingly vital to global supply chains, particularly for green energy technologies and defense applications, it is imperative to protect these resources from cyber threats. The suspected involvement of the hacker group BianLian in the Northern Minerals cyberattack has further intensified concerns. The group claims to have stolen extensive data, including corporate email archives and shareholder information, which was then posted on the dark web. Australia's proactive stance in managing foreign investment in its critical minerals sector, coupled with its efforts to mitigate cyber threats, sets an example for other nations facing similar challenges. By prioritizing national security and strengthening cybersecurity, Australia aims to ensure the sustainable and secure development of its strategic mineral resources. The cyberattack on Northern Minerals and the subsequent divestment orders by the Australian government highlights the intertwined nature of cybersecurity and national security in the mining industry. As cyber threats continue to evolve, so too must the strategies to defend against them, ensuring the resilience and security of critical industries worldwide. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A threat actor has claimed to be selling Iran's Hajj and Pilgrimage Organization's database on a hacking forum. This database is claimed to have over 168 million records. This database includes sensitive information such as full names, dates of birth, ID numbers, passport scans, financial information, and the source code for Hajj-related apps and services. The Hajj and Pilgrimage Organization is an independent state body that works with Iran's Ministry of Culture and Islamic Guidance. It organizes and monitors pilgrimage tours to Hajj, Umrah, and numerous locations in Iraq and Syria. The data, supposedly collected between 1984 and 2024, is said to be 1.25 terabytes (TB) in size. The threat actor announced on the forum, "More than 168 million database records (during the years 1984 to 2024) are ready for sale."

Claimed Hajj and Pilgrimage Organization Data includes

• Passport scans and photos of travelers • Travel flight information • Travel insurance details • Security deposit documents • Banking and payment information • Information about pilgrimage brokers • Accommodation status of travelers • Details of government officials • Allocated quotas for special groups like martyr families • Information on NAJA forces, Basij forces, and clerics (Mullahs) • Source code for Hajj apps and services [caption id="attachment_74631" align="aligncenter" width="1024"] Source: X[/caption]

Implications of Hajj and Pilgrimage Organization Data Breach

If the claim of a Hajj and Pilgrimage Organization data breach is real, the implication of the same might be far-reaching, perhaps touching millions of people. The disclosure of such broad and sensitive information might result in identity theft, financial loss, and major privacy violations for millions of individuals. Additionally, the exposure of the source code for Hajj-related apps and services could potentially compromise the security and functionality of these essential tools. Despite the seriousness of the claimed Hajj and Pilgrimage Organization data breach, the official website appears to be operating normally as no signs of foul play were seen upon accessing the site. The Cyber Express Team contacted the Hajj and Pilgrimage Organization to verify the allegations. However, no reaction has been received as of this time, making the threat actor's assertions unconfirmed. Amid the Israel-Iran conflict, the Middle East is experiencing another type of threats, like cyber warfare. Jordan finds itself at the center of this conflict, facing a series of claimed cyberattacks carried out by various hacktivist groups, out of which BlackMaskers Team emerged as a significant danger. The Team claimed responsibility for various cyberattacks on Jordan that targeted critical Jordanian entities from the stock exchange to private sector businesses. These cyberattacks are purportedly in response to Jordan's backing for Israel against Iran in the continuing conflict. The Cyber Express team will continue to actively follow the situation. We will give updates if new information becomes available, such as official confirmations or rejections from the Hajj and Pilgrimage Organization or other relevant agencies. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Singapore and Jakarta-based news website Tech in Asia has reportedly suffered a massive data breach. The alleged ‘Tech in Asia Data Breach’ seems to have affected a massive userbase of 230,000 users. The leaked data allegedly contains sensitive user information, which has raised concerns about potential identity theft and targeted attacks.

Understanding the Tech in Asia Data Breach: What Data Was Leaked?

Tech in Asia is headquartered in Singapore and the news website covers topics on startups and innovation in Asia. It was founded in August 2010. Threat Actor (TA) Sanggiero has claimed responsibility for the Tech in Asia Data Breach. The TA has allegedly published the leaked data on a popular hacking forum Breach Forums. The leaked data allegedly contains a significant amount of information pertaining to 230,000 users. Sanggiero also claimed that the sensitive information was breached in June 2024. According to the TA, the following data has been exposed. User ID: Each of 230,000 users has unique ids assigned within the Tech in Asia platform. Tech in Asia ID: The ID is potentially an internal identity which is specifically associated with the news platform Email Address: This is the crucial sensitive information that the users have submitted to the organization which the website uses to communicate apart from verifying their credentials. User Roles: The information that could be exposed includes the permission or access level granted to a user within the platform. Examples includes subscriber, writer or editor. Full Name: This includes sensitive information like both the first and last name details of the user. Display Name: This is the name chosen by the user to be displayed publicly on the Tech in Asia website which may or may not be the actual name. Registration Date: This is the date on which the user created his or her account on the news platform. Avatar URL: The avatar is nothing but the web address of the user's profile picture on Tech in Asia. Author URL: It could potentially be a link to the user’s home page or portfolio on which he or she publishes articles on within the Tech in Asia platform.

Exploiting Vulnerabilities: How Did Tech in Asia Data Breach Occur?

Threat Actor Sanggiero has claimed that he hacked the website and gained access to this large database by exploiting the vulnerabilities within the Tech in Asia's API (Application Programming Interface). API is a software intermediary that allows the TA to run two software applications to communicate with each other. Vulnerabilities within the Tech in Asia’s API could have allowed the hacker to gain unauthorized access to the data of 200,000 + users. The TA infact identified other bugs that allowed him to gain access to the website’s internal services.

What Should Affected Users Do?

These types of data breaches have become common across the globe. While it is currently unclear as to how the TA intends to use the stolen data, users in Tech in Asia must take the following precautionary steps: Change password: Users must immediately change their password on Tech in Asia platform apart from any other accounts that use the same login credentials. Beware of phishing attempts: Now that the hacker revealed that the email ids have been leaked, the users must be wary of targeted phishing attacks. They should not click any emails which requests them to share personal information or that share suspicious links. Monitor accounts: The users must also stay alert for unusual activity on their accounts in the news website or any accounts linked with the leaked email addresses. Tech in Asia Response Awaited At the time of publishing this article, Tech in Asia has yet to release an official statement regarding the data breach. However, it is expected that they will soon address the data breach and outline steps to users to safeguard their data and also on the efforts taken to prevent future data breaches. The article will be updated as more the organization updates its response. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A recent series of cyberattacks observed on the British Columbia government networks from state hackers may have compromised the personal information of its employees, authorities said. Shannon Salter, head of the B.C. Public Service, on Monday, provided an update on a recent cyber investigation. She disclosed that hackers, who attacked government networks in April "may have" accessed 22 email inboxes of provincial employees. Among these, a few inboxes contained sensitive personal information on 19 individuals, primarily consisting of employee personnel files. Salter confirmed that individuals potentially impacted by the breach have been notified. As a precaution, they will be offered credit monitoring and identity protection services. Despite the potential access, there has been no identified misuse of the information or evidence indicating that specific files were accessed by the threat actor. The investigation so far has not found hackers accessing any sensitive information collected by the government in the delivery of public services. Additionally, officials clarified that the cyberattack was not a ransomware attack and appears to have been carried out by a state or state-sponsored actor. Public Safety Minister Mike Farnworth reiterated Salter's comments and told reporters in a press briefing:

"At this time, we have no indication that the general public's information was accessed."

British Columbia Cyberattacks Timeline

Hackers penetrated artificial intelligence (AI) company Hugging Face's platform to access its user secrets, the company revealed in a blog post. The Google and Amazon-funded Hugging Face detected unauthorized access to its Spaces platform, which is a hosting service for showcasing AI/machine learning (ML) applications and collaborative model development. In short, the platform allows users to create, host, and share AI and ML applications, as well as discover AI apps made by others.

Hugging Face Hack Exploited Tokens

Hugging Face suspects that a subset of Spaces' secrets may have been accessed without authorization. In response to this security event, the company revoked several HF tokens present in those secrets and notified affected users via email.

"We recommend you refresh any key or token and consider switching your HF tokens to fine-grained access tokens which are the new default," Hugging Face said.

The company has not disclosed the number of users impacted by the incident, which remains under investigation. Hugging Face said it has made "significant" improvements to tighten Spaces' security in the past few days, including org tokens that offer better traceability and audit capabilities, implementing key management service, and expanding its systems' ability to identify leaked tokens and invalidate them. It is also investigating the breach with external cybersecurity experts and reported the incident to law enforcement and data protection agencies.

Growing Threats Against AI-as-a-Service Providers

Risks faced by AI-as-a-service (AIaaS) providers like Hugging Face are increasing rapidly, as the explosive growth of this sector makes them a lucrative target for attackers who seek to exploit the platforms for malicious purposes. In early April, cloud security firm Wiz detailed two security issues in Hugging Face that could allow adversaries to gain cross-tenant access and poison AI/ML models by taking over the continuous integration and continuous deployment (CI/CD) pipelines. “If a malicious actor were to compromise Hugging Face's platform, they could potentially gain access to private AI models, datasets and critical applications, leading to widespread damage and potential supply chain risk," Wiz said in a report detailing the threat. One of the security issues that the Wiz researchers identified was related to the Hugging Face Spaces platform. Wiz found that an attacker could execute arbitrary code during application build time, enabling them to scrutinize network connections from their machine. Its examination revealed a connection to a shared container registry that housed images belonging to other customers, which the researchers could manipulate. Previous research by HiddenLayer identified flaws in the Hugging Face Safetensors conversion service, which could enable attackers to hijack AI models submitted by users and stage supply chain attacks. Hugging Face also confirmed in December that it fixed critical API flaws that were reported by Lasso Security. Hugging Face said it is actively addressing these security concerns and continues to investigate the recent unauthorized access to ensure the safety and integrity of its platform and users.

Live Nation, the parent company of Ticketmaster, has confirmed "unauthorized activity" on its database after hackers claimed to have stolen the personal details of 560 million customers. The revelation of the Ticketmaster data breach came through a filing to the U.S. Securities and Exchange Commission (SEC), where Live Nation disclosed that a criminal actor had offered what was purported to be company user data for sale on the dark web. In a filing to the US SEC, Live Nation said that on 27 May "a criminal threat actor offered what it alleged to be Company user data for sale via the dark web", and that it was investigating.

Company Mitigating Ticketmaster Data Breach

The company further informed in the filing that they are working to mitigate risk to their users and the Company, and have notified and are cooperating with law enforcement. "As appropriate, we are also notifying regulatory authorities and users with respect to unauthorized access to personal information," reads the filling. The Ticketmaster data breach was initially identified on May 20, 2024. This is when Live Nation detected unauthorized activity within a third-party cloud database environment primarily housing data from its subsidiary, Ticketmaster L.L.C. On knowing this, Live Nation immediately launched an investigation with forensic investigators to determine the extent and nature of the data breach. According to the filing, the company is working diligently to mitigate risks to both its users and its overall operations. The company said in the filing that as of the date of this filing, the incident has not had, and we do not believe it is reasonably likely to have, a material impact on our overall business operations or on our financial condition or results of operations. “We continue to evaluate the risks and our remediation efforts are ongoing,” said the Officials of Live Nations in the filling.

Snowflake Coming Into Picture

What is more interesting is that a spokesperson for Ticketmaster told TechCrunch that its stolen database was hosted on a Boston-based cloud storage and analytics company, Snowflake. The Cyber Express earlier reported that a threat actor had allegedly taken responsibility for data breaches of Ticketmaster and Santander Bank, claiming they stole data after hacking an employee account at Snowflake. However, at that time, Snowflake shot down these data breach claims, attributing the breaches to poor credential hygiene in customer accounts instead. But now in light of the data breach, Snowflake and third-party cybersecurity experts, CrowdStrike and Mandiant, provided a joint statement related to their ongoing investigation involving a targeted threat campaign against some Snowflake customer accounts. Snowflake said in a post that it had informed a “limited number of customers who we believe may have been impacted” by attacks “targeting some of our customers’ accounts.” However, Snowflake did not describe the nature of the cyberattacks, or if data had been stolen from customer accounts. “We believe this is the result of ongoing industry-wide, identity-based attacks with the intent to obtain customer data. Research indicates that these types of attacks are performed with our customers’ user credentials that were exposed through unrelated cyber threat activity. To date, we do not believe this activity is caused by any vulnerability, misconfiguration, or malicious activity within the Snowflake product,” reads the Snowflakes bog.

Some of the Key Findings of Snowflake’s Investigation

• No evidence suggests that the activity was caused by a vulnerability, misconfiguration, or breach of Snowflake’s platform.
• There is no evidence pointing to compromised credentials of current or former Snowflake personnel.
• The campaign appears to be targeted at users with single-factor authentication.
• Threat actors have leveraged credentials obtained through infostealing malware.
• A threat actor accessed demo accounts of a former Snowflake employee, which did not contain sensitive data and were not connected to Snowflake’s production or corporate systems. The accounts were not protected by Multi-Factor Authentication (MFA).

Along with the findings, they have also suggested some of the steps that affected organization need to take:

Recommendations for Enhanced Security

1. Enforce Multi-Factor Authentication (MFA) on all accounts.
2. Set up Network Policy Rules to allow access only to authorized users or from trusted locations (e.g., VPN, Cloud workload NAT).
3. Reset and rotate Snowflake credentials for impacted organizations.

Live Nation’s infrastructure, including that of Ticketmaster, is primarily hosted on Amazon Web Services (AWS). Although AWS had not commented on the breach, a customer case study mentioning their involvement was recently removed from Amazon’s website. Before this, Australian authorities, the Department of Home Affairs announced that it is investigating a cyber incident impacting Ticketmaster customers, “working with Ticketmaster to understand the incident,” said a spokesperson from the department

The University of Hyderabad (UoH), a prominent academic institution in India, finds itself entangled in a cybersecurity challenge as a recent data breach seems to have affected the top management and students of the institution. Speaking to The Cyber Express, senior faculty members and top management expressed surprise over the University of Hyderabad data breach, which has left students worried over the repercussions. The university is situated in Telangana, a state in southern India and had recently achieved a prestigious ranking of being among the top 12 per cent of universities worldwide for international students.

Decoding University of Hyderabad Data Breach

The UoH data breach was first reported in the last week of May 2024. A Threat Actor (TA), who used the alias "nik20", shared a post on the data breach site BreachForums. The TA claimed to possess a database stolen from the university, allegedly in SQL format, a common database language used by many websites and applications.

What Was Leaked?

• User ID: A unique identifier assigned to each user within the UoH system.
• User Login: The username or credential used by users to access UoH online services.
• Hashed User Password: Passwords are typically stored in a hashed format, a one-way encryption process that makes it difficult, but not impossible, for attackers to decipher the original password.
• User Nickname: An optional field that users may choose to display instead of their full name.
• User Email Address: The primary email address associated with the user's account in the university. This is a critical piece of information often used for communication and account verification purposes.
• User URL: Potentially a link to a user's profile page or other online presence associated with the UoH account.
• User Registration Date: The date the user created their account within the UoH system.
• User Activation Key: A unique code used to verify a user's email address during the account registration process.
• User Status: An indicator of the user's account status, such as active, inactive, or suspended.
• Display Name: The name a user chooses to be displayed within the UoH system which may differ from their actual name.
• Access to spam and deleted messages’ folders of the users.

The TA shared that few of the users whose accounts were reportedly compromised included the UoH’s Admin, Public Relations Officer (PRO), UoH Herald-newsletter of the university and Vasuki Belavadi- a former dean and professor at the Department of Communications. The post by the TA also suggested that the database was originally dumped on BreachForums in March 2023. There is a possibility that “nik20” obtained the data from a previous breach that wasn't widely publicized or that the information is outdated.

University of Hyderabad Database Leak: University Puzzled but Promises Action

When The Cyber Express spoke to stakeholders at the university regarding the data breach, they initially expressed shock but later accepted the possibility of a breach owing to their previous experiences. A student named Balakrishna, who is currently pursuing PhD at the university, was apprehensive and shared that he was concerned over his research papers being compromised due to the data breach. However, Sanjay Kumar Sharma, Director, Computer Network Facility, UoH, who is responsible for all technology related undertakings at the institute, was confident that the breach was not alarming as sensitive data was not compromised. “Previously there was a similar hack in the School of Life Sciences. So there is a possibility of this data being breached too. However, I can assure you that the data that could be breached is not that sensitive since it could only contain research material from students, which is publicly available anyway,” he said. “We will be constantly checking what is happening. There have been many data breach attempts previously, and our security is such that the attempt was rendered disabled in the initial stages itself. I agree there could be deficiencies and we will keep improving. We will cross-check this data breach and alert all our users. We will not take it casually,” Sanjay added.

User Vigilance Can Help Avoid Cyber Incidents

While the University of Hyderabad investigates the situation, users outside can take cue from this breach and take a few healthy steps to protect themselves. This includes being wary of phishing attempts by hackers, monitoring suspicious links and keeping an eye out for any unusual activity on their accounts, such as unauthorized login attempts or changes to their profile information. They can also enhance their security measures by enabling Two-Factor Authentication (2FA) and change their passwords regularly.

A threat actor has reportedly taken responsibility for recent data breaches involving Ticketmaster and Santander Bank, claiming they stole data after hacking an employee account at Snowflake, a third-party cloud storage company. Snowflake, however, has shot down these breach claims, attributing the breaches to poor credential hygiene in customer accounts instead.

"To date, we do not believe this activity is caused by any vulnerability, misconfiguration, or malicious activity within the Snowflake product," the cloud storage giant said in a statement today.

Snowflake's AI Data Cloud platform serves more than 9,000 customers, including major companies such as Adobe, AT&T, Capital One, DoorDash, HP, JetBlue, Mastercard, Micron, NBC Universal, Nielsen, Novartis, Okta, PepsiCo, Siemens, US Foods, Western Union, and Yamaha, among others.

Alleged Snowflake Breach Details

According to cybersecurity firm Hudson Rock, the threat actor claims to have accessed data from additional high-profile companies using Snowflake's services, including Anheuser-Busch, State Farm, Mitsubishi, Progressive, Neiman Marcus, Allstate, and Advance Auto Parts. The method described involved bypassing Okta's authentication by using stolen credentials to log into a Snowflake employee's ServiceNow account. From there, they allegedly generated session tokens to extract data from Snowflake customers. Hudson Rock reported that the threat actor claimed the breach affected up to 400 companies, showing evidence of access to over 2,000 customer instances related to Snowflake's Europe servers.

Extortion Attempt and Malware Involvement

The threat actor claimed to have attempted to extort Snowflake for $20 million to buy back the stolen data, but Snowflake did not respond. Hudson Rock noted that a Snowflake employee was infected with a Lumma-type Infostealer in October, which stole their corporate credentials. The malware infection was supported by screenshots shared by the threat actor.

Snowflake Responds

Snowflake has confirmed breaches of customer accounts but denied that any vulnerability or misconfiguration in its products was exploited. The cloud storage company stated that they observed unauthorized access to certain customer accounts , which they said is likely unrelated to any flaws in Snowflake's infrastructure.

"We believe this is the result of ongoing industry-wide, identity-based attacks with the intent to obtain customer data. Research indicates that these types of attacks are performed with our customers’ user credentials that were exposed through unrelated cyber threat activity.

Snowflake has notified the "limited" number of customers about these attacks and urged them to enhance their account security by enabling multi-factor authentication (MFA).

Tools and Indicators of Compromise

The company published a security bulletin containing Indicators of Compromise (IoCs), investigative queries, and guidance for securing affected accounts. One IoC indicates that the threat actors used a custom tool named "RapeFlake" to exfiltrate data from Snowflake's databases. Another showed the use of "DBeaver Ultimate" data management tools, with logs indicating connections from the "DBeaver_DBeaverUltimate" user agent. Snowflake also shared query to identify access from suspected clients and how to disable a suspected user. But this might not be enough. A very important step here is: "If you have enabled the ALLOW_ID_TOKEN parameter on your account, the user must be left in the disabled state for 6 hours to fully invalidate any possible unauthorized access via this ID token feature.  If the user is re-enabled before this time the attacker may be able to generate a new session using an existing ID token, even after the password has been reset or MFA has been enabled." While a threat actor claims to have breached Snowflake and accessed data from numerous high-profile companies, Snowflake maintains that these breaches resulted from compromised customer accounts rather than any inherent vulnerabilities in their systems. Snowflake continues to investigate the incidents and has taken steps to improve customer account security.

Hawk Eye, a popular citizen-friendly crime reporting app of Telangana State Police in India, appears to have been hit by a massive data breach, a claim that sources have unofficially confirmed for The Cyber Express. The Hawk Eye app data breach was reportedly masterminded by a threat actor who goes by the name "Adm1nFr1end." The claim that the Hawk Eye app had been hacked emerged May 29 on the data leak site BreachForums. The threat actor claimed that they were revealing the stolen database, which consists of the Personally Identifiable Information (PII) of users, including the names, email addresses, phone numbers, physical addresses, IMEI numbers, and their location coordinates. To substantiate the data breach claim, the threat actor attached sample records, with the latest timestamp of May 2024, while disclosing that the database includes 130,000 SOS records, 70,000 incident reports, and 20,000 travel detail records (screenshot below).

Login Data Exposes Hawk Eye App Data Breach

The Hawk Eye App was launched by the Telangana Police in December 2014 for both Android and iPhone users as part of its initiative to become a citizen-friendly and responsive police force. Denizens were encouraged to use the app to report on a wide range of activities, including traffic violations, passing on information about criminals, violations by police, and crime against women, and also to pass on suggestions to the lawmen for improved policing and to credit the good work done by them. A key feature of the app is the SOS button for accessing help in case of emergencies. While logging into the App, users are required to share their personal details, including name, email ID, mobile number and password for registration. The app currently has a 4.4 rating on the Google Play Store, with more than 500,000 downloads on Android alone. [caption id="attachment_73712" align="alignnone" width="720"] Source: Hawk Eye App on Android[/caption]

Hawk Eye App Data Breach Samples

A few of the samples exposed by the threat actor revealed that one woman had filed a complaint on the Hawk Eye App to share that a man had initially promised to marry her and is now facing threats from him and his family. Alarmingly, the data leak revealed her name, mobile number, location, date, and time of complaint, potentially putting her at risk. In several other cases, citizens had filed complaints of traffic violations, and their data used initially to login to the App, including name, email address, and phone numbers, were revealed in the data breach. What is noteworthy about the above examples is that all these users had filed complaints only in May 2024, which suggests that the data from the Hawk Eye App was hacked this month.

Cops Wary of Hawk Eye App Data Breach

When The Cyber Express downloaded the “Hawk Eye -Telangana Police” app on Android on May 31, the app remained non-functional after the tester entered the primary details. Surprisingly, the app did not appear when the user tried to download it from the Apple Store. Sources in the Telangana Police have confirmed to The Cyber Express that there was a failure to upgrade the app and the process for updating a patch is an ongoing exercise. Police sources in the Telangana IT wing shared that they were working with vendors to install an updated patch. This, the police officials shared, could be a reason for the app details being breached. Additional Director General of Police (Technical Services) VV Srinivasa Rao of the Telangana Police shared that the task of upgrading Hawk Eye has been given to developers and that it should be available for the latest Android versions shortly. DGP Shikha Goel, who is also the director of the Telangana State Cyber Security Bureau, was unavailable for comment. We update this story as we get more information. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

CL0P ransomware group has claimed to have added Cooperativa de Crédito y Vivienda Unicred Limitada to their growing list of victims. The group alleges they have exfiltrated various sensitive financial documents, including invoices and forms, from Unicred cyberattack. The CL0P ransomware group, known for its high-profile cyberattacks, has detailed basic information about Unicred on their leak site, including links to the cooperative's official website. Unicred, founded in 1989 by a consortium of experienced businessmen and financial professionals, specializes in various financing instruments, such as the assignment of deferred payment checks, invoice credits, electronic invoices, and work certificates. The cooperative, with a reported revenue of $15.3 million, has built a reputation for its expertise in credit administration. [caption id="attachment_73263" align="aligncenter" width="678"] Source: X[/caption] Despite the serious nature of CL0P's claims, initial investigations show no immediate signs of a cyberattack on Unicred's official website, which remains fully operational. To clarify the situation, The Cyber Express Team reached out to Unicred's officials. However, at the time of writing, no response has been received, leaving the ransomware group's assertions unverified. [caption id="attachment_73265" align="aligncenter" width="819"] Source: X[/caption] [caption id="attachment_73266" align="aligncenter" width="793"] Source: X[/caption]

Potential Impact of the Alleged Unicred Cyberattack

Should the CL0P ransomware group's claim of a Unicred cyberattack be validated, the repercussions could be substantial for both Unicred and its customers. Ransomware attacks typically involve not only the exfiltration of sensitive data but also the potential for that data to be publicly released or sold, leading to severe privacy breaches and financial loss. Given Unicred's role in handling significant financial transactions and sensitive customer information, a confirmed Unicred cyberattack could undermine customer trust, disrupt business operations, and result in regulatory scrutiny and potential fines. The exposure of financial documents and personal data could also lead to identity theft and financial fraud, posing a serious threat to the affected individuals.

CL0P Ransomware Notorious Track Record

The CL0P ransomware group has a well-documented history of targeting high-profile organizations. Earlier this month, the group listed three new victims on its leak site: McKinley Packing, Pilot, and Pinnacle Engineering Group. In January 2024, CL0P claimed responsibility for compromising S&A Law Offices, a prominent India-based firm specializing in litigation services and intellectual property rights. The cybercriminals posted sensitive employee details, including phone numbers, addresses, vehicle numbers, PAN card details, internal communications, and other personally identifiable information (PII) as proof of the breach. In 2023, the CL0P group was behind a series of significant data breaches exploiting the MOVEit vulnerability. This widespread campaign led the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) to issue a joint cybersecurity advisory. The advisory disseminated Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) associated with CL0P's operations, emphasizing the group's threat to organizations across various sectors.

Conclusion

The alleged cyberattack on Cooperativa de Crédito y Vivienda Unicred Limitada by the CL0P ransomware group highlights the ongoing and evolving threat landscape in the digital age. While the claims remain unverified, the potential impact on Unicred and its customers is a reminder of the importance of cybersecurity vigilance. As CL0P continues to target high-profile entities, organizations must prioritize cybersecurity to protect their data, maintain customer trust, and ensure business continuity. As this situation develops, further verification and responses from Unicred will be crucial in determining the full extent of the impact and the measures needed to address it. Meanwhile, the cybersecurity community must remain vigilant and proactive in countering the ever-present threat of ransomware attacks. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Toshiba America Business Solutions reached out to customers to inform them of a potential data security incident in which their personal information may have been compromised. Toshiba America Business Solutions is an American subsidiary of the Toshiba TEC Corporation. The company said that it was committed to protecting the confidentiality and security of personal data, and offered credit monitoring services to affected individuals.

Toshiba America Data Breach

After conducting a preliminary investigation, Toshiba reported that an attacker may have compromised its email environment. The attacker may have obtained unauthorized access to sensitive personally identifiable information such as names and Social Security numbers from the email compromise. The investigation confirmed that the breach could have impacted numerous individuals, leading Toshiba to contact affected individuals, as legally required. Toshiba America Business Solutions advised customers to remain cautious over the incident. The firm advised customers to regularly review their credit reports, financial account statements, and payment card statements for any unauthorized activity. Any suspicious activity could be reported to Toshiba or law enforcement agencies. Toshiba apologized to the affected individuals for any inconvenience stemming from the incident and said that additional measures had been implemented since then to enhance the security of its email environment and prevent similar occurrences in the future. To assist the affected individuals in safeguarding their personal information, Toshiba has arranged for a complimentary, two-year membership of identity monitoring services offered through Kroll. This membership offering includes triple bureau credit monitoring, fraud consultation, and identity theft restoration. The fraud consultation option allows affected individuals  to reach out to Kroll fraud specialists for advice and assistance relating to identity protection, legal rights, and detection of suspicious activity. The identity theft restoration option lets affected individuals work with a licensed Kroll investigator to resolve potential identity theft issues. Toshiba stated that these services would be provided for free to the affected individuals and would not negatively impact their credit scores. Affected individuals were encouraged to use the services as well as to contact Toshiba or Kroll for additional assistance.

Law Firm Announces Investigation

Strauss Borrelli PLLC, a data breach law firm, announced on its website that it would be investigating Toshiba American Business Solutions, Inc. with regard to the recent data breach that exposed sensitive personally identifiable information. While the full extent of the data breach is unknown, the Toshiba America Business Solutions division operates offices across the U.S. and Latin America. The law firm encouraged customers who received a breach notification letter from Toshiba American Business Solutions to contact Strauss Borrelli PLLC to discuss their rights and potential legal remedies in response to the incident. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Pharmaceutical giant Johnson & Johnson recently announced a data breach that may stem from a larger data breach affecting Lash Group, a division of Cencora. In February, Cencora reported a data breach incident to the U.S. Securities and Exchange Commission (SEC) after learning that data had been exfiltrated from its information systems, some of which contained personal information. The breach may have compromised some sensitive information of patients registered with Johnson & Johnson Patient Assistance Foundation, Inc.

Johnson & Johnson Data Breach Notice

On May 29, Johnson & Johnson filed a notice of data breach with the Attorney General of Texas, indicating that an unauthorized party accessed confidential patient information. The breach affected approximately 175,000 Texans, but the total number of victims nationwide could be much higher. The breach affects two Johnson & Johnson entities: Johnson & Johnson Patient Assistance Foundation, Inc., and Johnson & Johnson Services, Inc. The following data was compromised in the attack: Name of individual, Address, Medical Information, and Date of Birth. Data breach notification letters have been sent to all the affected individuals, while limited information is available on the Texas Attorney General's data breach reports page. The incident is potentially linked to a much larger breach involving Cencora, which has affected over a dozen major pharmaceutical companies so far.

Link to Cencora Data Breach

The Johnson & Johnson data breach bears several similarities to other large third-party pharmaceutical company data breaches affected by the Cencora/Lash Group data breach, which was first discovered on February 21. Cencora’s Lash Group division aids pharmaceutical companies in running patient support programs that try to ensure that costly medication is available to disadvantaged patients, regardless of their ability to pay for them. At least 15 clients of Cencora/Lash Group have notified state authorities of data breach incidents, with databreaches.net listing the following victims:

• AbbVie: 54,344 Texans affected
• Acadia Pharmaceuticals: 753 Texans affected
• Bayer: 8,822 Texans affected
• Bristol Myers Squibb and/or the Bristol Myers Squibb Patient Assistance Foundation: 256,237 Texans and 11,503 New Hampshire residents affected
• Dendreon: 2,923 Texans affected
• Endo: no numbers provided
• Genentech: 5,805 Texans affected
• GlaxoSmithKline Group of Companies and/or the GlaxoSmithKline Patient Access Programs Foundation: no numbers provided
• Incyte Corporation: 2,592 Texans affected
• Marathon Pharmaceuticals, LLC/PTC Therapeutics, Inc.: 466 Texans and 27 New Hampshire residents affected
• Novartis Pharmaceuticals: 12,134 Texans affected
• Pharming Healthcare, Inc.: 314 Texans and 9 New Hampshire residents affected
• Regeneron Pharmaceuticals: 91,514 Texans affected
• Sumitomo Pharma America, Inc.: 24,102 Texans affected
• Tolmar: 1 New Hampshire resident

Data breach notices have also been filed with California officials too. While the full extent of the damage has yet to be determined, it has affected over 540,000 patients so far. Cencora stated in its notification to the Securities and Exchange Commission that it had not yet been able to determine if the incident had a material impact on its operations. In in a notice on its website, the Leash Group indicated that personal information as well as personal health information had been potentially affected, including first name, last name, date of birth, health diagnosis, and/or medications and prescriptions. The Leash Group said in a statement that no personal data appears to have been exposed because of the incident:

“There is no evidence that any of this information has been or will be publicly disclosed, or that any information was or will be misused for fraudulent purposes as a result of this incident, but we are communicating this so that affected individuals can take the steps outlined below to protect yourself.”

The Leash Group is offering free credit monitoring and remediation services to affected individuals, and additional guidance on dealing with suspected breaches of personal information. No perpetrator has been identified or named as being responsible for the attack, and the potential impact of the breach is still being assessed. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The notorious Akira ransomware group has added another victim to its growing list of targeted organizations, striking at Western Dovetail, a prominent woodworking company founded in 1993 by Maxfield Hunter, its president, and CEO, along with support from his father, George Hunter, and brother, Josh Hunter. The family-owned business, known for its dedication to woodworking craftsmanship, has become the latest casualty of cybercrime. The Akira ransomware group took to online forums to announce their latest Western Dovetail data breach, proclaiming the availability of "a few GB of their data" for public access. The compromised data reportedly includes sensitive employee information such as addresses, emails, phone numbers, and even details of relatives, along with tax and payment information, and a snippet of medical records.

Western Dovetail Cyberattack: Verification Efforts and Official Response

Despite this disclosure, Akira has remained tight-lipped about their motives behind targeting Western Dovetail. Upon investigating Western Dovetail's official website, no signs of foul play were immediately evident, as the website appeared to be fully functional. To corroborate further, The Cyber Express Team reached out to Western Dovetail officials for comment. However, at the time of compiling this report, no official response had been received, leaving the claim of the Western Dovetail data breach unverified. [caption id="attachment_72947" align="aligncenter" width="850"] Source: X[/caption]

Akira Ransomware Trail of Cyber Destruction

The latest cyberattack on Western Dovetail adds to a growing list of cyber onslaughts orchestrated by the Akira ransomware group. In April 2024, the group was identified as the mastermind behind a series of devastating cyberattacks targeting businesses and critical infrastructure entities across North America, Europe, and Australia. According to the U.S. Federal Bureau of Investigation (FBI), Akira has breached over 250 organizations since March 2023, raking in a staggering $42 million in ransom payments. Initially focusing on Windows systems, Akira has expanded its tactics to include Linux variants, raising alarm bells among global cybersecurity agencies. Before targeting Western Dovetail, the ransomware group had set its sights on prominent entities such as DENHAM the Jeanmaker, a renowned denim brand based in Amsterdam, and TeraGo, a Canada-based provider of secure cloud services and business-grade internet solutions.

Conclusion and Awaited Response

In the wake of the Western Dovetail cyberattack, the cybersecurity landscape remains fraught with uncertainty. While the company's official response is eagerly awaited, the incident serves as a reminder of the ever-present threat posed by cybercriminals. As organizations strive to protect themselves against such cyberattacks, collaboration between cybersecurity experts, law enforcement agencies, and affected entities becomes increasingly crucial in combating the pervasive menace of ransomware. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The British Broadcasting Corporation (BBC) is investigating a data breach that exposed sensitive information belonging to over 25,000 present and past employees. The BBC data breach, which occurred within the corporation's pension scheme, has triggered a reaction from authorities regarding cybersecurity protocols. The pension scheme, in an email dispatched to its members, highlighted the gravity of the BBC employee data breach, emphasizing that the incident is being treated with the utmost seriousness. Approximately 25,290 individuals have been impacted by this breach, according to statements made by scheme representatives. Talking about this cybersecurity incident and its legal repercussions with The Cyber Express, Lauren Wills-Dixon, data privacy expert at law firm Gordons, stated that data breaches that lead to "unauthorised access to personal data is classed as a personal data breach under data protection laws".

BBC Data Breach Impacts Current and Former Employees

According to Birmingham Live, the security incident is being taken "extremely seriously” by the BBC and there is “no evidence of a ransomware attack.” Despite speculation of a possible ransomware attack, the British public service broadcaster has dispelled any conjecture, asserting that there is currently no evidence supporting this theory. The BBC clarified that the breach stemmed from private records being illicitly accessed from an online data storage service. Catherine Claydon, Chair of the BBC Pension Trust, assured employees that swift action had been taken to address the breach and secure the affected data source, The Guardian reported.  In an email sent to the staff, Claydon reassured the employees that “BBC have taken immediate steps to assess and contain the incident.” Talking about the mitigation strategies, the organization stated “We are working at pace with specialist teams internally and externally to understand how this happened and take appropriate action. As a precaution, we have also put in place additional security measures and continue to monitor the situation.”  The legal obligation of this data breach are far reaching and in cases where the incident impacts individual rights and freedoms, "this comes with a regulatory obligation to notify the Information Commissioner, and where people are at "high risk" the affected organisation must notify those individuals too without undue delay", said Lauren.

BBC Employee Data Breach and Ongoing Investigation

Despite assurances from the BBC, concerns linger regarding the potential misuse of the compromised information. Employees have been advised to remain vigilant and report any suspicious activity promptly. The breach, though attributed to a third party cloud storage provider, threatens the security of the impacted individuals, and "BBC - and any ‘data controller’ under data protection laws - remains primarily responsible for the security measures it adopts and external providers it engages to store and protect its personal data", added Lauren. Moreover, no passwords or bank details "appear to have been compromised, but the advice for those individuals involved is to be vigilant of any unusual activity or requests". Acknowledging the severity of the breach, a spokesperson for the BBC pension scheme issued a sincere apology to affected members. Reassurances were offered regarding the swift response and containment of the breach, coupled with ongoing efforts to upgrade security measures and monitor the situation closely. Inquiries into the incident are ongoing, with external cybersecurity experts collaborating with internal teams to dissect the breach and its implications thoroughly. However, as of now, no official statement has been issued regarding the involvement of ransomware groups in the breach. This is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the BBC employee data breach or any official response from the organization.

For over two decades, Google search rankings have functioned as the internet's invisible puppeteer, dictating which websites rise to the top of search results and influencing the online landscape in profound ways. SEO professionals have tirelessly analyzed Google's every move, piecing together cryptic clues to optimize websites for coveted top rankings. But the inner workings of this algorithmic behemoth have largely remained a mystery – until now. A recent massive leak of internal Google documents has sent shockwaves through the SEO community and beyond. The trove, titled "Google API Content Warehouse" and exceeding 2,500 pages with 14,014 attributes, offers an unprecedented look at Google's search API and the intricate web of factors that influence search results. [caption id="attachment_72485" align="aligncenter" width="406"] Source: X[/caption] Google has now pulled down its documentation, which specified the parameters that the company has been using for generating and ranking Search results, after accidentally publishing it on GitHub. The American technology giant published the “Google API Content Warehouse” documentation on the GitHub platform on March 27, 2024, and pulled it back on May 7. An anonymous source, who has now revealed himself as Erfan Azimi, CEO and director of SEO for digital marketing agency EA Eagle Digital, had shared the leak with SEO veteran Rand Fishkin. It promises to be a potential goldmine of information. However, Fishkin cautioned that it's not a straightforward recipe for guaranteed SEO success. “The sheer volume of information, with some components potentially outdated, presents a complex puzzle for SEO professionals to decipher,” he cautioned. While the documents’ leak shed light on what Google might consider, they don't reveal the specific ranking hierarchy. This missing piece makes it difficult to prioritize optimization efforts and leaves room for interpretation. The leak has also ignited debate regarding Google's past pronouncements on SEO.  Fishkin suggests discrepancies between the leaked documents and previous statements from Google employees, particularly concerning "domain authority" – a website's overall ranking power. The documents seem to suggest that domain authority carries more weight than Google has publicly acknowledged. Google, as of yet, has maintained a stony silence regarding the leak's authenticity. This lack of response has fueled speculation within the SEO community. However, it's important to consider the leak within the context of Google's recent algorithmic update prioritizing "helpful content." This update reflects Google's ongoing battle against manipulative SEO tactics and its commitment to elevating content that genuinely serves user needs.

Potential Implications of the Google Search Ranking Leak

The ramifications of the leak extend far beyond the realm of SEO. Here are some key areas potentially impacted: Transparency and Trust: The leak raises questions about Google's transparency regarding its search algorithms. Inconsistent messaging between leaked documents and public statements can erode trust with website owners and content creators. Evolving Search Landscape: The leaked documents offer valuable insights into Google's current approach to search ranking. However, search algorithms are constantly evolving, and the information may not hold true for extended periods. The Future of SEO: While the leak provides a valuable snapshot, it shouldn't be misconstrued as a definitive SEO guide. SEO professionals still need to adapt to Google's ongoing algorithmic changes and prioritize creating high-quality content that resonates with users.

Industry Buzzing with Reactions on Social Media over Google Search Algorithm

There have been multiple reactions from stakeholders on social media over the leak. Rand Fishkin declared the leak the biggest ever on the mysteries of Google ranking algorithms: “In the last quarter century, no leak of this magnitude or detail has ever been reported from Google’s search division. If you're in SEO, you should probably see this.” [caption id="attachment_72507" align="aligncenter" width="723"] Source: X[/caption] iPullRank founder and CEO Mic King has acknowledged the leak as a newsworthy event but advises caution. He suggested that the leaked documents might be incomplete or outdated and may not reveal the entire picture of Google's ranking factors. He also suggested that website owners shouldn't drastically alter their SEO strategies based solely on this leak. “This leak is another indication that you should be taking in the inputs and experimenting with them to see what will work for your website. It’s not enough to look at anecdotal reviews of things and assume that’s how Google works. If your organization does not have an experimentation plan for SEO, now is a good time to start one,” he said. [caption id="attachment_72525" align="alignnone" width="741"] Source: X[/caption] SEO Consultant Aleyda Solis has raised concerns about the leak's potential to erode trust between Google and website owners. She said that transparency was a major concern in SEO, and if there were discrepancies between what Google said and what the leaked documents revealed, it could damage trust.   [caption id="attachment_72531" align="alignnone" width="678"] Source: X[/caption]

Google Yet to React to Document Leak

Even though this leaked data reveals the factors that Google Search might consider when ranking search results, it doesn't reveal how important each factor is or how much "weight" it carries in the final ranking decision. The data could be helpful for SEO professionals who constantly adapt their strategies to keep pace with Google Search's ranking changes and strive for higher rankings. Upon reviewing these documents, many stakeholders claimed to have found discrepancies between what Google has publicly stated about how Search works and what the leaked information suggests. Google has not yet issued a public statement regarding the leak. The company announced its most recent major Search update in March, focusing on surfacing more authentic content that is demonstrably "helpful." This update involved modifications to Google's core ranking systems to identify pages that were "created for search engines instead of people." Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The notorious hacker group 888 has claimed responsibility for a Shell data breach targeting the British multinational oil and gas company. According to their claims, approximately 80,000 individuals could be affected by this breach across several countries, including the United States, United Kingdom, Australia, France, India, Singapore, the Philippines, the Netherlands, Malaysia, and Canada. The compromised data, shared by the threat actor on a hacking forum, includes a range of sensitive information related to Australian users. The sample data contained information about shopper codes, first and last names, email addresses, contact mobile numbers, postcodes, Nectar information, site addresses, and transaction details. Notably, these transactions appear to be associated with Reddy Express (Formerly Coles Express) locations in Australia.

An Alleged Claim of Shell Data Breach Surfaces

[caption id="attachment_72512" align="alignnone" width="1080"] Source: Dark Web[/caption] The claims of this Shell data leak were shared on a popular hacking forum by the user Kingpin and shared glimpses into sample data allegedly related to the organization. The Cyber Express has reached out to the oil and gas company to learn more about this Shell data breach and the authenticity of the hackers over the claimed data.  However, at the time of writing this, no official statement or response has been received. This lack of confirmation leaves the claims regarding the Shell data breach unverified, although the potential implications are threatening for the customers and stakeholders associated with the organization.  Talking about the cyberattack on Shell, the hacker Kingpin states that the organization suffered a data breach in May 2024 and this data breach allegedly contained "Shopper Code, First Name, Last Name, Status, Shopper Email, Contact Mobile, Postcode, Nectar, Suburb, State, Site Address, Suburb 1, Country, Site Name, Last Login, Pay and Association Number".

A Similar Incident from the Past

This purported breach is not the first time Shell has been targeted by cyberattacks. In the past, the company has faced similar security incidents, including a ransomware attack and a data security incident involving Accellion’s File Transfer Appliance. These incidents highlight the persistent threat posed by cybercriminals to organizations, particularly those in the energy sector. In response to previous incidents, Shell had emphasized its commitment to cybersecurity and data privacy. The company has initiated investigations into the recent breaches and is working to address any potential risks to affected individuals and stakeholders. Additionally, Shell had previously contacted relevant regulators and authorities to ensure compliance with data protection regulations and to mitigate the impact of the previous breach. The current Shell data leak is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on this alleged Shell data breach or any official confirmation from the organization. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A cybersecurity threat has surfaced targeting DU Emirates Integrated Telecommunications Corporation, a major telecom provider in the UAE. On the XSS Forum, a cybercriminal known as "Ddarknotevil" has claimed to have stolen over 360 GB of data from DU. The alleged DU Emirates data breach reportedly includes sensitive information such as employee email addresses, network logs, details of 371,000 customers' devices, IP addresses, and proprietary telecommunication software. To substantiate these claims, Ddarknotevil shared sample records, including customers' device details and excerpts from email content purportedly obtained from an employee's mailbox. The threat actor is offering this entire database as a one-time purchase for USD 3,200. This development follows previous activity on May 19, 2024, where Ddarknotevil was seen privately offering unauthorized FTP access to DU's systems. Despite the claims of DU Emirates data breach, a visit to DU's official website revealed no signs of disruption; the website was fully operational. The Cyber Express team has reached out to DU officials for verification, but as of this report, no official response has been received, leaving the DU Emirates data breach claim unverified.

Context of Recent Cyber Threats in the Telecom Sector

The alleged data breach of DU Emirates comes on the heels of several high-profile cyberattacks within the telecommunications sector. In February 2024, ETISALAT, the state-owned Emirates Telecommunications Group Company PJSC in the UAE, reportedly suffered a ransomware attack attributed to the infamous LockBit ransomware faction. LockBit claimed to have successfully breached ETISALAT's systems and demanded $100,000 for the return of the stolen data, setting a deadline of April 17th. This claim, too, remains unverified. Adding to the urgency of these developments, Spain-based mobile telephony company Llamaya, a subsidiary of the MASMOVIL Group, reported a significant data breach just days before the purported ETISALAT attack. A threat actor known as “DNI” claimed to have accessed sensitive customer information, including phone numbers, passwords, and personal details, affecting approximately 16,825 customers. These incidents highlight a disturbing trend of cyber threats targeting the telecommunications sector globally. Mobile operators are increasingly vulnerable to sophisticated cyberattacks, as evidenced by recent incidents involving Monobank in Ukraine and a popular mobile banking app with over 10 million users. These alleged cyberattacks highlight the critical need for robust cybersecurity measures to protect digital infrastructure.

Implications of the Alleged DU Emirates Data Breach

If the claims by Ddarknotevil are confirmed, the implications for DU Emirates Integrated Telecommunications Corporation and its customers could be severe. The compromised data includes not only customer information but also critical network logs and proprietary software, potentially exposing the company to various risks:

1. Customer Data Exposure: The breach of 371,000 customers' device details, including IP addresses, could lead to significant privacy violations. Customers may face increased risks of identity theft, phishing attacks, and other forms of cyber fraud.
2. Operational Disruptions: Access to network logs and proprietary software could allow cybercriminals to exploit vulnerabilities within DU’s systems, potentially disrupting services and causing widespread operational issues.
3. Reputation Damage: A confirmed breach of this magnitude would severely damage DU’s reputation, leading to a loss of customer trust and potentially impacting the company’s market position.
4. Financial Losses: Beyond the immediate costs of responding to the breach, DU could face significant financial losses from potential lawsuits, regulatory fines, and a decline in customer base.
5. National Security Concerns: Given DU's prominence in the UAE’s telecommunications landscape, a breach could have broader national security implications, especially if critical communication infrastructure is affected.

Broader Industry Implications

The surge in cyberattacks on telecom operators signals a pressing need for the industry to enhance its cybersecurity defenses. The trend underlines the vulnerabilities inherent in the digital infrastructure that supports critical communication services. Telecommunications companies must invest in advanced security technologies, conduct regular security audits, and foster a culture of cybersecurity awareness among employees to mitigate these threats. Moreover, collaboration with government agencies and international cybersecurity organizations can help telecom operators stay ahead of emerging threats. Sharing intelligence and best practices can enhance the overall resilience of the telecommunications sector. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Within a mere two-day period, two major companies have allegedly fallen victim to cyberattacks. The first incident came to light on May 27, 2024, when an individual known by the alias "SpidermanData" claimed to have infiltrated Ticketmaster Entertainment, LLC, potentially exposing sensitive data of approximately 560 million users, including their card details. Hot on the heels of this breach, another hacker group, Shiny Hunters, disclosed on May 29 that they had targeted Live Nation Entertainment, Inc., the parent company of Ticketmaster. In their recent announcement, Shiny Hunters claimed to have obtained a substantial cache of data, which includes comprehensive customer profiles, details of ticket sales, and partial credit card information. They reportedly have 1.3 terabytes of this stolen data, which they are offering for sale at a price of $500,000. Notably, their disclosure also mentioned a massive database breach involving "560M Users + Card Details." This figure matches an earlier claim by "SpidermanData," who reported a similar breach at Ticketmaster Entertainment, LLC. The claims by Shiny Hunters and SpidermanData concerning the breach affecting 560 million users highlight significant security issues at Ticketmaster and Live Nation. The fact that both reports involve identical data figures raises the possibility that this could either stem from a common vulnerability in the companies’ cybersecurity frameworks or represent the same incident claimed by two different hackers.. [caption id="attachment_72309" align="aligncenter" width="1024"] Source: X[/caption] Despite these troubling claims, a review of Live Nation's official website revealed no apparent signs of disruption. The Cyber Express team contacted Live Nation for confirmation, but has not received an official response at the time of this report. Until the company confirms, the accuracy of these breach claims remains uncertain.

Alleged Live Nation Entertainment Data Breach Details

• Customer Information: Full details including names, addresses, emails, and phone numbers.
• Ticket Sales and Event Data: Information about ticket purchases and event specifics.
• Credit Card Information: Last four digits, expiration dates, and associated customer details.
• Customer Fraud Details: Comprehensive data points including fraud-related information.

The timing of this alleged Live Nation Entertainment data breach is particularly troubling for Ticketmaster, coinciding with a series of major music festivals scheduled between May 2024 and January 2025. Among the most anticipated events is the FOREIGNER concert tour, starting on June 11, 2024, in the United States and concluding on November 9, 2024. Other notable acts include HEART, Allison Russell, Hozier, Ian Munsick, Prateek Kuhad, and Kathleen Hanna, each set to perform across North America during the same period. The supposed breach not only threatens the security of millions of users but also casts a shadow over the festive atmosphere of these upcoming events. The cybercriminals have allegedly divided the compromised data into 15 parts, offering samples from two segments. One dataset reportedly from the ‘PATRON’ database includes extensive personal information, while the other encompasses customer sales data, detailing event IDs and payment methods.

Unconfirmed Live Nation Data Breach Adds to Worry

Adding to the turmoil, Ticketmaster is currently embroiled in a lawsuit filed by the U.S. Department of Justice. The lawsuit accuses the company of anti-competitive practices, including limiting venue options and threatening financial repercussions. This legal battle follows public outrage over ticketing issues during Taylor Swift’s tour, where high prices and post-pandemic demand intensified scrutiny. Live Nation denies monopolistic behavior, but the lawsuit contends their dominance drives up prices. The alleged Ticketmaster data breach poses another threat to the organization, as databases of this caliber are highly sought after on the dark web. The recent string of alleged breaches raises questions about the motives behind these cyberattacks. Whether they are tactics to gain attention or have other underlying motives, the truth will only be known once official statements are released. For now, Ticketmaster customers are advised to remain vigilant. Regular monitoring of financial accounts and immediate reporting of suspicious activities are crucial steps in mitigating potential damage. Furthermore, customers should be wary of phishing attempts and other forms of cyber fraud that often follow such breaches. As the situation unfolds, the focus remains on ensuring the security and trust of Ticketmaster’s extensive user base. The company’s response to these allegations and their ongoing legal challenges will be critical in determining its future standing in the highly competitive entertainment industry. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The First American Financial Corporation, one of the largest title insurance companies in the United States, revealed that a cyberattack in December 2023 exposed the personal information of around 44,000 people. The First American data breach disclosure was made in a filing with the U.S. Securities and Exchange Commission (SEC) on May 28, 2024, raising serious concerns about data security at the company. The filing disclosed that attackers had breached some of First American's systems and accessed sensitive data without authorization. "As of the date of this filing, the Company’s investigation of the incident has concluded. Based upon our investigation and findings, the Company has determined that personal information pertaining to approximately 44,000 individuals may have been accessed without authorization as a result of the incident," the company stated. In response to the First American data breach, the company committed to notifying the affected individuals and providing them with credit monitoring and identity protection services at no cost. This proactive measure aims to mitigate the potential fallout for those whose data was compromised. "The Company will provide appropriate notifications to potentially affected individuals and offer those individuals credit monitoring and identity protection services at no cost to them," the company stated in filing. [caption id="attachment_72061" align="aligncenter" width="1603"] Source: SEC[/caption]

First American Cyberattack: A Troubled History

The December 2023 data breach occurred just a month after First American settled a significant cybersecurity incident from 2019. On November 29, 2023, the company agreed to pay a $1 million penalty to New York State for violating cybersecurity regulations. This penalty stemmed from a May 2019 breach where the company's proprietary EaglePro application exposed personal and financial data. The breach allowed unauthorized access to documents without proper authentication, exposing sensitive information from hundreds of thousands of individuals. The New York Department of Financial Services (DFS) criticized First American's security practices, noting that the company's senior management had been aware of the vulnerability in EaglePro. The DFS's findings underscored the importance of robust cybersecurity measures, especially for companies handling large volumes of personal and financial data.

Industry-Wide Challenges

First American is not alone in facing cybersecurity threats. In November 2023, Fidelity National Financial, another major American title insurance provider, experienced a cybersecurity incident. The cyberattack forced Fidelity to take down some of its systems to contain the breach, causing disruptions to its business operations. In January 2024, Fidelity confirmed in an SEC filing that the attackers had stolen data from approximately 1.3 million customers using non-self-propagating malware. These cybersecurity reflect a broader trend of increasing cyberattacks targeting financial institutions, emphasizing the need for enhanced cybersecurity frameworks across the industry. Title insurance companies, which handle vast amounts of sensitive information, are particularly attractive targets for cybercriminals.

The Road Ahead for First American Data Breach

The latest Frist American data breach marks another challenge for the company as it strives to regain trust and enhance its cybersecurity posture. The company must address both immediate and long-term security concerns to protect against future incidents. This includes investing in advanced security technologies, conducting regular security audits, and fostering a culture of cybersecurity awareness among employees. Moreover, regulatory scrutiny is likely to intensify. Financial institutions are expected to adhere to stringent cybersecurity standards, and any lapses can result in substantial penalties and reputational damage. First American's recent history indicates a pressing need for the company to strengthen its defenses and ensure compliance with all regulatory requirements.

Customer Impact and Response

For the 44,000 individuals affected by the December 2023 Frist American data breach, offer of free credit monitoring and identity protection services is a critical step. These services can help detect and prevent potential misuse of their personal information. However, the emotional and psychological impact of knowing their data has been compromised cannot be understated. Customers should remain vigilant, monitoring their financial accounts for any suspicious activity and taking advantage of the protection services offered by First American. Additionally, they should be aware of phishing attempts and other forms of cyber fraud that often follow such breaches. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

TRC Staffing is at the center of a concerning data breach, leaving personal information vulnerable to cybercriminals. Murphy Law Firm has taken action on behalf of the victims, investigating legal avenues for those affected by this security incident. The TRC Staffing data breach was discovered on April 12, 2024, and exposed a security flaw within TRC's network.  Cybercriminals exploited this vulnerability between March 25, 2024, and April 12, 2024, gaining unauthorized access to sensitive data belonging to approximately 158,593 individuals. Names and Social Security numbers were among the compromised information, heightening concerns about potential identity theft and fraud. Explaining the lawsuit to interested parties, Murphy Law Firm, stated that they are "evaluating legal options, including a potential class action lawsuit, to recover damages for individuals who were affected by the data breach.

Understanding the Full Extent of the TRC Staffing Data Breach

In response to this TRC Staffing breach, Murphy Law Firm is actively engaging on behalf of those impacted. Their investigation aims to uncover the full extent of damages and explore avenues for legal recourse, including the possibility of a class action lawsuit. Individuals who have received notifications of the breach or suspect their information may have been compromised are urged to take action. By visiting the dedicated page at https://murphylegalfirm.com/cases/trc-data-breach/, affected parties can access information regarding their rights and legal options. The repercussions of this breach extend beyond mere inconvenience. With personal and highly confidential information potentially circulating on the dark web, the identity of users is at risk. Murphy Law Firm recognizes the urgency of addressing these concerns and is advocating for the rights of those affected.

How Can Victims Join the TRC Staffing Lawsuit?

To join the lawsuit and seek potential compensation, individuals can fill out a contact form provided by Murphy Law Firm. This form requires essential details such as name, contact information, and whether a breach notification letter was received. Additionally, users can provide any relevant information regarding fraud or suspicious activity they may have experienced. For those seeking guidance or further assistance, Murphy Law Firm can be reached directly via email at abm@murphylegalfirm.com or by phone at (405) 389-4989. Protecting the rights and interests of individuals affected by the TRC Staffing data breach is important, and Murphy Law Firm represents the victims with a legal process.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A cybercriminal going by the alias "SpidermanData" has claimed to breach and advertise a massive database purportedly linked to Ticketmaster Entertainment, LLC. The claim of the Ticketmaster data breach, dated May 27, 2024, was posted on the cybercrime forum Exploit and shares threatening information about the organization, including database of “560M Users + Card Details”. The threat actor has also claimed to have access to 1.3TB of stolen data and is currently selling it for $500k. The post, accompanied by sample data, suggests that the data indeed belongs to Ticketmaster Entertainment. However, the American ticket sales and distribution company has yet to share any information about this alleged Ticketmaster data breach.  Additionally, apart from the Ticketmaster data breach, the company is also facing a lawsuit from The Justice Department for anti-competitive practices, limiting venue options, and threatening financial consequences. The lawsuit follows public outcry, including ticketing issues during Taylor Swift's tour. High prices, fueled by post-pandemic demand, have intensified scrutiny. Live Nation denies monopolistic behavior, but the lawsuit contends their dominance drives up prices. The Ticketmaster data breach poses another threat to the organization since databases of this caliber are usually the hot-selling items on the dark web. 

Ticketmaster Data Breach: The Worst Time to Have a Cybersecurity Incident

SpidermanData claims to have access to a staggering 560 million records brimming with personally identifiable information (PII) of customers, including sensitive payment card details. This breach couldn't have come at a worse time for Ticketmaster, coinciding with the onset of several major music festivals scheduled between May 2024 and January 2025.  Among these highly anticipated events is the FOREIGNER concert, featuring legendary rock acts led by Mick Jones and Kelly Hansen. The musical act will begin on June 11, 2024, in the United States and will conclude on November 9, 2024. Following suit is the iconic band HEART, set to perform across the United States from July to November 2024, culminating in an international concert in Calgary, AB, Canada. Meanwhile, Allison Russell and Hozier are primed to perform from May to August 2024. Adding to this list of bands performing this year, artists like Ian Munsick, Prateek Kuhad, and Kathleen Hanna will also go on tours across North America between 2024 and 2025. However, the jubilant atmosphere surrounding these events is now overshadowed by the threat of, one of the biggest data breaches, threatening millions of users globally.  The purportedly compromised data, amounting to a staggering 1.3 terabytes, has been divided into 15 parts, with the hacker offering samples from two segments. One dataset, extracted from a 'PATRON' database, contains a plethora of personal information, including names, addresses, emails, and phone numbers. Meanwhile, the other dataset includes information about customer sales, encompassing crucial details like event IDs and payment methods.

The Aftermath and Industry Implications

SpidermanData has listed the entire dataset for sale, quoting a hefty price tag of USD 500,000, and restricting the sale to a single buyer. The gravity of this situation cannot be overstated, with the compromised data posing significant risks of identity theft, financial fraud, and other criminal activities - something we've already seen in previous data breaches like the MOVEit File Transfer incident.  Live Nation Entertainment, the parent company of Ticketmaster, stands as a global juggernaut in the live entertainment domain, organizing and promoting thousands of shows annually across more than 40 countries. Meanwhile, Ticketmaster's pivotal role in facilitating ticket sales for musical and non-musical events highlights its significance within the industry, making it a prime target for cybercriminals seeking to exploit vulnerabilities for personal gain. The current Ticketmaster data breach is not the first time that the organization has faced a cyberattack. In November 2020, the company faced a hefty £1.25 million fine from the Information Commissioner's Office (ICO) following a payment data breach in 2018. The breach, stemming from a vulnerability in a third-party chatbot, compromised the personal and payment details of over nine million customers in Europe, triggering widespread fraud and financial losses. Whether the current data breach represents a resurgence of previously compromised data or the acquisition of freshly stolen data, the premise origin of the information about the databases remains unclear. Nevertheless, The Cyber Express will be closely monitoring the situation and we’ll update this post once we have more information on the Ticketmaster data leak or any official confirmation from the organization.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A recent data breach has reportedly compromised the personal information of Decathlon employees in Spain. The threat actor known as 888 has taken responsibility for the Decathlon data leak, which allegedly involves a database containing sensitive details of 6,644 employees of the popular sporting goods retailer.   This database reportedly includes employees' email addresses, headquarters information, and transportation activities. The claim was disseminated through multiple posts on social media platform X (formerly Twitter), suggesting that not only employee information but also potentially sensitive customer data may have been exposed. Moreover, the threat actor also provided a sample of the Decathlon leaked database.  Earlier this month, a significant data breach involving the retailer Decathlon in Spain was made public. The compromised data was subsequently published on a popular hacking forum, raising concerns about the security of employee information.  [caption id="attachment_71535" align="aligncenter" width="1117"] Source: X[/caption] [caption id="attachment_71537" align="aligncenter" width="1169"] Source: X[/caption] As of the time of this writing, Decathlon has not issued an official statement regarding the alleged data breach. The Cyber Express has contacted the retailer for verification of the breach and will provide updates as soon as a response is received. 

Decathlon Could Face Repercussions if Breach is Confirmed 

There is a critical need for large retailers to implement strong security measures. Data protection regulations, like the General Data Protection Regulation (GDPR) in Europe, enforce strict penalties on companies that fail to protect customer data.  A confirmed data breach could erode customer trust in Decathlon, potentially impacting its sales and overall market position. If the data breach is confirmed, Decathlon could also be hit with significant legal and financial penalties. 

Stakeholders to Take Precautions 

Following the allegations of Decathlon Data Leak, the company’s stakeholders including customers should take immediate steps to safeguard their personal information. This includes changing passwords for both Decathlon accounts and any other accounts that use the same password. Additionally, customers should monitor bank and credit card statements closely for any suspicious transactions.  They should be cautious of emails or messages that appear to be from Decathlon but might be phishing attempts trying to capitalize on this situation.  As the situation unfolds, it remains to be seen how Decathlon will address these serious allegations. The company needs to conduct a comprehensive investigation to determine the scope of the breach and implement stronger security measures to prevent similar incidents in the future.  In the meantime, customers and stakeholders will be looking for updates and reassurances from Decathlon regarding these developments. 

Second Major Decathlon Data Leak After 2021 

This is not the first time that Decathlon is in the firing line for data breach. A data leak of around 8,000 Decathlon global employees was previously discovered and reported in 2021. The personal information of these employees was then shared on the dark web and was reported in October 2023. This revelation was discovered by the firm’s research team in an online forum post that surfaced on September 7, 2023.  The forum user uploaded a 61-MB database purportedly linked to Decathlon. As per the post, this database is said to include personally identifiable information (PII) of approximately 8,000 Decathlon employees.  The data that was exposed in the Decathlon data breach also reportedly contained a range of sensitive information, such as full names, usernames, phone numbers, email addresses, details of countries and cities of residence, authentication tokens, and even photographs. The data leak also featured information from Bluenove, a technology and consulting firm as well.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information. 

The impact of the Cencora data breach is far more widespread than earlier thought as more than a dozen pharmaceutical giants including Novartis and GlaxoSmithKline disclose personal and health information data leaks stemming from the February breach incident. Cencora Inc., formerly recognized as AmerisourceBergen, and its Lash Group affiliate announced in a February filing with the Securities and Exchange Commission (SEC) that the company faced a cybersecurity incident where “data from its information systems had been exfiltrated.” Cencora is a major pharmacy company with over 46,000 employees and approximately $262.2 billion in revenue in 2023. Based in Pennsylvania, it operates in around 50 countries globally. The popular American drug wholesaler did not disclose the extent of the data breach in its February SEC filing but did confirm at the time that some of the data exfiltrated in the attack could contain personal information. Last week, however, Cencora and The Lash Group clients began notifying state Attorneys General about a data breach that stemmed from the February cybersecurity incident at Cencora. At least 15 pharmaceutical companies reported that the personal data of hundreds of thousands of individuals were compromised. Notifications identified the following affected companies:

• AbbVie Inc.
• Acadia Pharmaceuticals Inc.
• Bayer Corporation
• Bristol Myers Squibb Company and Bristol Myers Squibb Patient Assistance Foundation
• Dendreon Pharmaceuticals LLC
• Endo Pharmaceuticals Inc.
• Genentech, Inc.
• GlaxoSmithKline Group of Companies and the GlaxoSmithKline Patient Access Programs Foundation
• Incyte Corporation
• Marathon Pharmaceuticals, LLC/PTC Therapeutics, Inc.
• Novartis Pharmaceuticals Corporation
• Pharming Healthcare, Inc.
• Regeneron Pharmaceuticals, Inc.
• Sumitomo Pharma America, Inc. / Sunovion Pharmaceuticals Inc.
• Tolmar

State Attorneys General often announce data breaches without specifying the number of affected people but AG’s office in Texas does disclose the number impacting the state residents. Based on these partial numbers, at least 542,000 individuals seem to be impacted from the Cencora data breach, till date. The Cyber Express reached out to Cencora for confirming the total number of individuals impacted to understand the full extent of the data breach but did not receive any communication till the time of publishing the article.

Cyber Forensic Findings from the Cencora Data Breach

Cencora detected the cyberattack on February 21, and took immediate action to contain and prevent further unauthorized access. Based on the investigation that likely concluded in April, Cencora said personal information including first name, last name, address, date of birth, health diagnosis, and medications and prescriptions was compromised in the attack. AmerisourceBergen Specialty Group (ABSG), a unit of Cencora, said Friday the breach involved data of a prescription supply program run by the now defunct subsidiary, Medical Initiatives Inc. Further details on how the supply program was exploited remain unclear. U.S. has been rocked by a host of cybersecurity breaches linked to the healthcare industry in recent days. While Change Healthcare cyberattack was one of the most notable ones, the Medstar and Ascension breaches have displayed the vulnerability of the healthcare sector to cyberattacks. The latest in the list of healthcare data breaches is the Sav-Rx data breach that compromised the health data of more than 2.8 million people. Cencora’s investigation, however, found no connection with other major healthcare cyberattacks and, in its notifications, said they were unaware of any actual or attempted misuse of the stolen data. The company said it has not seen any public disclosure of the stolen data, till date. The affected individuals have been offered 24 months of credit monitoring and identity theft remediation services at no cost and steps have also been taken to harden defenses to prevent such security breaches in the future. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.