Research reports
1,224 reports from 387 publishers45 added in the past week
51 reports, newest added first
Added Thu 23 Apr
Babuk re-organizes as Payload Bin, offers its first leak
At the end of April, threat actors known as Babuk indicated that they were closing up shop and switching to a different model: Babuk changes direction, we no longer encrypt information on networks, we will get to you and take your data, we will notify you…
Negotiations with the Akira ransomware group: an ill-advised approach
@Chum1ng0 took a look at four victims of Akira and what happened in terms of negotiations or not. In translation: After a detailed analysis, we identified four chats from different companies that attempted to communicate with Akira after being attacked. Some…
Ransomware
A former DarkSide listing shows up on REvil's leak site
On May 15, Chum1ng0 reported that German furniture retailer Möbelstadt Sommerlad had been hit by DarkSide threat actors. By then DarkSide’s leak site was down and it had not been possible to confirm whether DarkSide had ever listed the retailer as a victim or…
Added Sat 11 Apr
Henry Schein re-encrypted by BlackCat again
On Saturday, October 14, Henry Schein, Inc. (Nasdaq: HSIC) determined that a portion of its manufacturing and distribution businesses experienced a cybersecurity incident. Henry Schein promptly took precautionary action, including taking certain systems…
Ransomware
A chat with DarkSide
If you would meet us on the street – you would never realize that we are cyberpests, because we are the same normal people like everyone else. Many have families and children, the only thing that these circumstances in which we found themselves in our country…
"Almost everything you have posted in your news article about this incident is a total crap" -- BlackCat to Bangladeshi news outlets
On June 23, using the greeting that Hive ransomware always used in emailing victims, AlphV wrote to the Bangladesh Krishi Bank (BKB). Typos, grammar, and spelling as in the original: Hello,Ladies and Gentlemen! This is ALPHV Ransomware Team. We are here to…
Ransomware
Desorden Group claims to have stolen 200 GB of data from ABX Express
DataBreaches.net has been contacted by a threat actor or group calling themselves “Desorden Group” (“Desorden”). The group claims to have hacked ABX Express Enterprise servers in Malaysia on September 23. We have stolen more than 200 gigabytes of files and…
Desorden is back, declares an attack on MISTINE Better Way Thailand Company
It’s been a while since DataBreaches has seen any announcements from Desorden, but the group contacted DataBreaches over the weekend to claim responsibility for a hack and data breach of Better Way Thailand Company Limited, a personal care products and…
Thai loyalty membership card data of 5 million customers put up for sale on hacking forum
Central Group is a multinational conglomerate in Thailand that describes itself as one of the largest private commercial conglomerates in Thailand with more than 50 subsidiaries and six key business lines. In October 2021, DataBreaches reported an attack on…
Major Indian fashion retailer hacked and data leaked
Another major Indian firm has fallen prey to a massive cyberattack. This time, the victim is a Fortune India 500 List company: Mumbai-headquartered Aditya Birla Group (ABG). The conglomerate includes Aditya Birla Fashion and Retail Ltd. (ABFRL) as well as…
Today's insider threat: Ardyss edition
Here’s today’s reminder of the insider threat. And also the external threat. Consider it a pre-holiday twofer. DataBreaches was contacted yesterday by “0mid16B,” the same individual who was responsible for previously hacking The1 Card, Thailand’s most popular…
Exclusive: Apex Custom Software hacked, threat actors threaten to leak the software (1)
On January 20, the hackers known as 0mid16B tweeted, “At 7:40AM 20th Jan (US time), a US healthcare software provider has been hacked. All data in server has been deleted. 48 hours left before we publish all data.” The attached screenshot showed a listing of…
TH: Major Cineplex and Major Development PCL hit by DESORDEN
DESORDEN has hit another big business in Thailand. This time it is the largest cinema chain and its subsidiary property development company. As DESORDEN informs DataBreaches, the Major Development PCL was breached during the first week of August and contacted…
REvil ransomware threat actors reveal their gaming company victim
In a recent interview with Yelisey Boguslavskiy, “UNKN” of the threat actors known as REvil (Sodinokibi) indicated that they were planning a major attack on a gaming network. Today, the threat actors added GPI (Gaming Partners International) to their…
Ransomware
Desorden Group expands attack on Central Group after deal to pay them allegedly fell through
Yesterday, this site reported that Desorden Group hit Central Restaurants Group (CRG) in Thailand. A Desorden spokesperson had told this site that there would be more details to be revealed, and now there are. It appears that Centara Hotel Group is part of…
Malaysian Telecom RedOne hit by DESORDEN
As DESORDEN wrote on a popular hacking forum: This data breach involved both redONE databases and source coding. Personal data include full name, NRIC (national
Thai securities trading firm goes offline after cyberattack
It seems that yet another group of threat actors are trying the double-extortion method, replete with trying to get media coverage. “ALTDOS,” as they call themselves, contacted a number of news outlets in Thailand and online news sites to announce that they…
Sg: Vhive alerts consumers to cyberattack
Vhive, a popular retail furniture chain in Singapore, has posted a notice on their web site and Facebook page announcing a cyberattack that occurred on March 23. Based on information provided to DataBreaches.net by the threat actors, this appear to have been…
Recent cyberattacks put Thai citizens' privacy and data security at greater risk
In December of 2021, Thailand’s National Cyber Security Agency launched after being delayed by the COVID-19 pandemic. In February, it announced that it intended to roll out 40 subordinate regulations of the Cybersecurity Act this year to strengthen the…
From bad to worse: Doctor Alliance hacked again by same threat actor (2)
On November 12, DataBreaches reported that Doctor Alliance had allegedly been hacked by a threat actor who listed the data for sale on a clearnet forum. At the time, “Kazu” claimed to have 353 GB of data and had given Doctor Alliance a November 21 deadline to…
Vulnerabilities
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.