Pennsylvania Attorney General Confirms Data Breach After Ransomware Attack

According to the Pennsylvania Office of the Attorney General (OAG), the state’s top law officer, the Inc Ransom group has claimed responsibility for a data breach tied to a ransomware attack earlier this year, stating that it stole 5.7 TB of data and gained access to the internal network of the FBI. The OAG had previously disclosed that the cyberattack disrupted its website, email, and phone lines, with service outages lasting about three weeks.

In a data incident notice published by the OAG, officials said there was potential access to certain files containing personal information such as names, Social Security numbers, and medical details, though it noted there was no evidence of misuse at the time. SecurityWeek report author Eduard Kovacs notes that cybersecurity researchers suggested the breach may have been due to the exploitation of a Citrix Netscaler vulnerability known as CitrixBleed2.

The incident was first announced in August after the attack began, and the organization has not released a precise figure for how many individuals are affected. The disclosure adds to the ongoing scrutiny of ransomware risks faced by state agencies and their handling of sensitive data.