Research reports

Update: Daixin leaks more data from Bluewater Health and other hospitals; databases yet to be leaked

As some will likely have already noticed, Daixin Team released the second part of the data leak from five hospitals in Ontario that have IT services provided by TransForm SSO. The first leak, containing many patient records, was previously reported by…

Breaking: LockBit 3.0 gives Sick Kids free decryptor, claims to ban partner who attacked them

#LockBit has formally apologized for the attack on the Hospital for Sick Kids in Canada that took place on December 18. The hospital is still trying to recover from it. “We formally apologize for the attack on sikkids.ca and give back the decryptor for free,…

Ransomware

East Tennessee Children's Hospital updates information on ransomware incident

On March 15, this site noted that the East Tennessee Children’s Hospital had posted a notice about an IT security incident. At the time, they did not identify the incident as a ransomware incident. DataBreaches.net subsequently found some explanation for that…

Ransomware

Singapore real estate firm breached by ALTDOS

Singapore-based OrangeTee appears to have suffered a massive hack and data exfiltration by ALTDOS threat actors. “Your highly sophisticated work has exhausted us, both energy and financially,” the firm allegedly wrote to the threat actors on August 6. As this…

B&G Foods attacked by Daixin Team; files leaked

B&G Foods describes itself as a “multibillion dollar company with more than 50 brands and one purpose: Delicious food from our family to yours.” Some of the California firm’s brands are Crisco, Green Giant, Cinnamon Toast Crunch, Cream of Wheat, and Vermont…

Scattered Spider is NOT quiet. They're just under another name now.

Following recent arrests of alleged Scattered Spider members in the UK, Google Cloud’s Mandiant Consulting has reported a noticeable pause in the group’s activities, offering a “critical window of opportunity” for organizations to bolster their defenses,…

Takedowns and arrests

ShinyHunters sent Google an extortion demand; Shiny comments on current activities

Even the NSA can’t stop or identify us anymore. The FBI and everyone else is irrelevant and incompetent as far as we’re concerned :). When DataBreaches asked ShinyHunters if anything in particular had inspired that statement, “Shiny1” responded: I heard the…

Ransomware

If at first you don't succeed, screw it up again?

Unfortunately for AlphV, they did not seem to know that the law wasn’t in effect yet. Today, BlackCat tried again. Their leak site now lists Viking Therapeutics as a victim. Instead of providing any proof of claims, however, they posted that they got…

Ransomware

Revenge telecom hacking by DESORDEN Group; third attack threatened

DESORDEN Group has added a new transparency demand to their attacks against Malaysian entities: victims must disclose the breach publicly if they have not paid the attackers. If the victim doesn’t disclose and Malaysian media does not report the incident,…

Still think you can negotiate with REvil and get your files back? Read this first.

The government and professionals involved in ransomware incident response have often advised victims not to pay the ransom because even if you pay, you may not get your data back, and you may not get your data deleted by criminals who pinky swear that they…

Ransomware

"BlackCat" attempts to up the pressure on Suffolk County; starts to leak data?

Since September 8, Suffolk County has been trying to recover from a cyberattack by a ransomware group known as “ALPHV” or “BlackCat.” The attack disabled the county’s 911 system as well as other services. The county reverted to older methods for handling…

Ransomware

AlphV responds to MGM incident and sloppy reporting

AlphV has posted a statement about their attack on MGM Resorts. They also post some scathing criticisms of journalists and news outlets for reporting inaccurately and not verifying sources. Of note, their statement also asserts, “The ALPHV ransomware group…

Ransomware

Hacked on Christmas, DEphoto starts notifying customers, only to be attacked again

According to 0mid16B, they attacked DEphoto on December 25, and acquired the personal information of 555,952 customers, 429,597 orders with detailed personal information of 240,307 orders, and 16,213 records with plain text credit card details (full card…

DESORDEN leaks more data from Indonesia; "Indo data is officially worthless"

The DESORDEN group recently announced that due to the flood of personal information on Indonesians, they were giving up on attacking Indonesian entities. But they also noted that they already had some attacks in progress that they would still be leaking.…

Customer data from hundreds of Indonesian and Malaysian restaurants hacked by DESORDEN

Hackers known as DESORDEN have hit another big Indonesian business. This time, their victim was BOGA Group, which operates more than 200 restaurants and outlets across Indonesia and Malaysia under brand names including Bakerzin, Pepper Lunch, Paradise…

Alleged member of ShinyHunters held in Morocco on Interpol Red Notice, U.S. seeking extradition -- reports

A report by Vincent Monnier in a French news magazine, L’OBS, claims that an alleged member of ShinyHunters was arrested on June 1 as he attempted to board a flight at Rabat to Brussels. In translation, the report says: Arrested on June 1 at Rabat airport,…

Takedowns and arrests

Los Angeles' Housing Authority hit by LockBit - Claim

If folks in Los Angeles were upset about the ransomware incident involving the Los Angeles Unified School District, they might want to buckle up before reading this: It appears that LockBit 3.0 has managed to compromise and exfiltrate data from the Housing…

Ransomware

LAPSUS and the Terrible, Horrible, No Good, Very Bad Ransom Day 1 (UPDATED)

First they thought their victim hacked them back. Then they appeared to be trolled by a “negotiator” who wasn’t. I don’t know if the Brazilian threat actors who call themselves LAPSUS felt like moving to Australia after a bad day at the ransom office…

Ransomware

Acer under fire: Now hackers claim to have hit Acer Taiwan, too

DESORDEN threat actors are still going after Acer, it seems. In addition to their recent revelation that they exfiltrated 60 GB of data from Acer India — a breach that Acer confirmed — they have alerted DataBreaches.net that they have also successfully…

"I'm Not Pro-Russia and I'm Not a Terrorist!" —- InfraGard and Airbus Hacker “USDoD” Unveils His New Campaigns

The first time DataBreaches remembers hearing about the man who calls himself “USDoD” was when he posted a sales listing for member data from InfraGard. He had not only managed to acquire data on 80,000 members of an organization dedicated to protecting…