Malware

Data Breach Exposes Millions of Driver’s Licenses in Louisiana and Oregon

A data breach targeting the secure file transfer service, MOVEit, has compromised millions of Louisiana and Oregon state identification records. The breach was discovered by the security firm, Upguard, which found that a file transfer mode configuration error had left the data accessible to the public. The incident highlights the importance of secure data transfer protocols and the need for organizations to regularly audit their security measures.

Published

1 year ago

June 16, 2023

zendzipr

An image of a hand with water coming out of it.

IT Services in Louisiana and Oregon have warned that a data breach has resulted in the exposure of millions of driver’s licenses. The culprit is a ransomware gang that hacked their MOVEit Transfer security file transfer systems to steal the stored data.

The Clop ransomware operation conducted these attacks by exploiting a previously unknown zero-day vulnerability, tracked as CVE-2023-34362, on MOVEit Transfer servers worldwide since May 27th.

The attacks have led to data breaches worldwide, affecting companies, federal government agencies, and local state agencies.

Both the Louisiana Office of Motor Vehicles and the Oregon Driver & Motor Vehicle Services have confirmed using the MOVEit Transfer software, which was breached in these attacks.

Millions of Driver’s Licenses Stolen

The Louisiana Office of Motor Vehicles (OMV) issued a statement stating that they believe the data of all Louisianans with state-issued driver’s licenses, IDs, or car registrations has been exposed to the threat actors.

Louisiana’s Office of Motor Vehicles (OMV) is one of many government entities, major businesses, and organizations to be affected by the unprecedented MOVEit data breach,” explains an alert from the Louisiana OMV.

The OMV disclosed that those impacted likely had their names, addresses, social security numbers, birth dates, height, eye color, driver’s license numbers, vehicle registration information, and handicap placard information exposed. However, Clop has not used, sold, shared, or released any of the data, so it is possible that the stolen data may have been deleted as the ransomware actors promised in their announcement to delete any stolen government data.

“I want to tell you right away that the military, children’s hospitals, GOV etc like this we no to attack, and their data was erased,” the Clop gang told BleepingComputer in an email earlier this month.

Nonetheless, millions of Louisiana residents should still consider their data at risk and take necessary steps to protect their identity, reset their passwords, place a credit freeze on their bank accounts, and report any suspicious activities to the authorities and their card issuers.

The Oregon DMV released a statement stating that the MOVEit Transfer data breach impacted approximately 3,500,000 Oregonians with an ID or driver’s license.

“Since 2015, ODOT has used MOVEit Transfer, a popular file sharing tool created and supported by Progress Software Corp that allows organizations to securely transfer files and data between business partners and customers,” reads Oregon DMV’s press release.

“On Monday, June 12, ODOT confirmed that the accessed data contained personal information for approximately 3.5 million Oregonians. While much of this information is available broadly, some of it is sensitive personal information.”

The authorities in Oregon have stated that they are unable to identify specific victims, so all citizens are advised to take precautions and assume their personal data was exposed to cybercriminals.

While Clop started extorting victims of the MOVEit attacks by listing breached companies on the ransomware operation’s data leak site, no stolen data has yet to be leaked.

As both the Louisiana and Oregon DMV fall under the government category, it is too soon to tell if the Clop extortionists will keep their promise and delete stolen data. Even if this data is never used in extortion attempts, it is possible the data could be sold to other threat actors.

Therefore, all impacted people in Oregon and Louisiana should treat their data as at risk, monitor credit reports for identity theft, and remain vigilant against possible targeted phishing attacks.

Other organizations that have already disclosed MOVEit Transfer breaches include US federal agencies, Zellis (BBC, Boots, and Aer Lingus, Ireland’s HSE through Zellis), the University of Rochester, the government of Nova Scotia, the US state of Missouri, the US state of Illinois, BORN Ontario, Ofcam, Extreme Networks, and the American Board of Internal Medicine.

Up Next

“Unveiled: The Infamous BlackCat Ransomware Gang Responsible for the Devastating February Reddit Breach”

Don't Miss

8 Million Accounts Compromised in Latest Zacks Data Breach, Warns Have I Been Pwned

Mastermind Behind Healthcare Cyber Heist Faces a Decade Behind Bars

Hello there! I’m Peter Zendzian, and I have a riveting story to share with you. Picture this: you’re a patient at a reputable healthcare provider in the United States. You entrust them with your most sensitive personal information, and you feel secure knowing that they’ll protect you. But one day, you receive a notification that your information has been compromised due to a cyberattack. How would you feel? Angry? Scared? Confused? Well, that’s precisely what happened to millions of Americans in 2019 when a hacker targeted a prominent US healthcare provider and demanded a ransom to release the stolen data. Today, I’m here to tell you that justice has been served – the mastermind behind this cyber heist has been sentenced to 10 years in prison.

A Modern-Day Robin Hood?

Meet Arden James Zaloudek, a 24-year-old hacker who embarked on a cybercrime spree to ostensibly “help the poor.” However, instead of stealing from the rich, he targeted innocent patients and healthcare providers, causing widespread fear and panic. Zaloudek’s modus operandi was simple: he would infiltrate healthcare providers’ networks, steal sensitive patient data, and then demand a ransom in cryptocurrency. If the healthcare provider didn’t pay up, he would threaten to leak the stolen data on the dark web.

The Fallout from the Attack

As a result of Zaloudek’s actions, millions of Americans had their sensitive personal information – including names, addresses, social security numbers, and medical records – exposed. This led to a massive surge in identity theft and fraud cases, with victims scrambling to protect their information and financial assets. The healthcare provider itself also faced severe consequences, including reputational damage, expensive lawsuits, and the cost of upgrading its cybersecurity to prevent future attacks.

Justice Served, but at What Cost?

On February 3rd, 2023, Arden James Zaloudek was sentenced to 10 years in prison for his crimes. While it’s reassuring to know that justice has been served, the damage has already been done. The fallout from this attack underscores the urgent need for robust cybersecurity measures to protect sensitive information from falling into the wrong hands.

Why Cybersecurity Matters More Than Ever

As technology advances, so do the tactics of cybercriminals. Cybercrime is projected to cost the world $10.5 trillion annually by 2025, up from $3 trillion in 2015. This means that now, more than ever, it’s crucial for both individuals and organizations to prioritize cybersecurity.

Protect Yourself and Your Loved Ones

While you might not be able to single-handedly prevent cyberattacks on large-scale organizations, there are steps you can take to protect your personal information. Ensure you have strong, unique passwords for your online accounts, and consider using a password manager to keep track of them. Enable two-factor authentication wherever possible, and be cautious about sharing your personal information online.

Join Us in the Fight Against Cybercrime

I hope this story has highlighted the importance of cybersecurity in today’s digital world. If you’re concerned about your online security and want to learn more about how to protect yourself, I encourage you to reach out to us. Together, we can help make the online world a safer place for everyone. So don’t be a stranger – keep coming back to learn more about the latest cybersecurity news and tips. And remember, knowledge is power!

Click to comment

Malware

Massive Cyberattack at French Hospital: Health Data of 750,000 Patients Compromised

A cyberattack on a French hospital exposed the health data of 750,000 patients. The incident highlights the growing risk of cyber threats targeting healthcare organizations, with sensitive patient information being increasingly sought by hackers. Ensure your organization’s data is protected with robust cybersecurity measures and stay informed on the latest threats.

Published

9 hours ago

November 23, 2024

zendzipr

People walk in front of a brightly lit modern building adorned with a red cross sign, signaling it as a French hospital. Amidst whispers of a recent cyberattack targeting health data,

A data breach at a French hospital has led to the exposure of 750,000 patients’ medical records. The culprit, a threat actor going by the name ‘nears’, claims to have attacked multiple healthcare facilities in France, potentially gaining access to over 1.5 million patient records.

This attacker claims to have breached MediBoard, an Electronic Patient Record (EPR) solution by Softway Medical Group. The group has confirmed that a MediBoard account was indeed compromised, but it was not due to a software vulnerability or misconfiguration. Instead, the breach occurred through stolen hospital credentials.

How did this happen?

Softway Medical Group explained that the exposed data was not directly managed by them but was hosted by the hospital. They emphasized that their software was not responsible for the breach. Instead, a privileged account within the hospital’s infrastructure was compromised.

This situation highlights the importance of ensuring that all staff members, especially those with privileged access to sensitive systems, follow strict security protocols to prevent unauthorized access.

What’s at stake?

The threat actor began selling what they claimed was access to the MediBoard platform for multiple French hospitals. This access allegedly allowed the buyer to view sensitive healthcare and billing information, patient records, and even the ability to schedule and modify appointments or medical records.

To prove their claim, the hacker put the records of 758,912 patients from an unnamed French hospital up for sale. These records contain sensitive information, including full names, dates of birth, contact information, and even health card history.

The data was offered for purchase to three users, and currently, no buyers have been declared on the sale listing. However, even if the data isn’t sold, there’s always a risk of it being leaked online for free, making it accessible to the broader cybercrime community.

The dangers of exposed data

The type of data exposed in this incident raises the risk of phishing, scamming, and social engineering for impacted individuals. As a result, it’s crucial for healthcare providers to prioritize cybersecurity and invest in proper security measures to protect their patients’ sensitive information.

For patients, it’s essential to be vigilant and aware of potential scams and phishing attempts. Be cautious with any communication that seems suspicious or requests sensitive information, and never hesitate to verify the authenticity of a message.

What can you do to protect yourself?

With cyber threats constantly evolving, it’s essential to stay informed about cybersecurity best practices. As an IT Services company, we’re dedicated to helping people like you understand the risks and take appropriate action to protect your personal information and online security.

Don’t leave your cybersecurity to chance. Keep coming back to learn more about the latest threats, best practices, and how to keep yourself and your loved ones safe online. Together, we can build a more secure digital world for everyone.

Malware

Finastra Battles Massive Data Breach: Unraveling the SFTP Hack Impact on Fintech Titan

Fintech firm Finastra is probing a potential data breach following a hacking incident involving its SFTP server. The breach, which may have exposed sensitive user data, has prompted the company to bolster its security measures and notify affected customers.

Published

1 day ago

November 22, 2024

zendzipr

Did you know that even the largest and most successful financial software companies can fall victim to cyberattacks? Recently, Finastra, a company that serves over 8,000 institutions across 130 countries, experienced a cybersecurity incident that put their customers’ sensitive data at risk.

The Incident at Finastra

Finastra is a global financial software company that counts 45 of the world’s top 50 banks and credit unions among its clients. With over 12,000 employees and a revenue of $1.7 billion last year, it’s a major player in the finance sector. On November 7, 2024, a cyber attacker managed to access one of Finastra’s Secure File Transfer Platform (SFTP) systems using compromised credentials.

So far, the company’s investigation, supported by external cybersecurity experts, has not found evidence that the breach extended beyond the SFTP platform. But the attack has raised concerns about the security of the company’s software services, which include lending solutions, payment processing, cloud-enabled retail and banking platforms, and trading risk management tools.

How We Learned About the Breach

Brian Krebs first reported the security breach after seeing a data breach notification sent to an impacted person. The attack appears to be linked to a post on a hacking forum, where a threat actor named “abyss0” claimed to be selling 400GB of data stolen from Finastra.

When we asked Finastra about the forum post, they wouldn’t confirm or deny if the data belonged to them. However, they did acknowledge a limited-scope security breach and are currently evaluating its impact. They also stressed that the compromised SFTP platform was not used by all their customers and was not their default file exchange platform.

What’s Next for Finastra and Its Customers?

The exact impact and scope of the breach are still under investigation. It may take some time to determine who has been affected, but Finastra has assured that those who are deemed impacted will be contacted directly. As a result, public disclosures from the company are not expected.

Interestingly, the threat actor who published the data samples earlier this month has since deleted the post. It’s unclear whether the data was sold to a buyer or if “abyss0” became concerned about the sudden publicity.

A History of Cybersecurity Incidents

This isn’t the first time Finastra has experienced a cybersecurity incident. In March 2020, the company was hit by ransomware actors and forced to take parts of its IT infrastructure offline, causing service disruptions. At the time, reports highlighted Finastra’s lackluster vulnerability management strategy, as they were using older versions of Pulse Secure VPN and Citrix servers.

What Can We Learn From This?

The Finastra breach is a stark reminder that no organization is immune to cyber threats. As technology continues to evolve, so do the tactics and techniques used by cybercriminals. It’s crucial for companies, large and small, to prioritize cybersecurity and invest in the latest security measures to protect their customers’ data.

And for you, as a reader and potential customer, it’s important to stay informed about the latest cybersecurity news and best practices. That’s where we come in. We’re committed to providing you with the most up-to-date information on cybersecurity, so you can stay one step ahead of the bad guys. So why not reach out to us and keep coming back to learn more about how you can protect yourself and your business from cyber threats?

Malware

Ford Dismisses Data Breach Accusations, Asserts Customer Information Remains Secure

Ford has denied allegations of a data breach, assuring customers that their information remains secure. The automaker responded to claims made by a security researcher who discovered a vulnerability in their systems, stating that no sensitive data was accessed or exposed. Ford is working closely with the researcher to investigate and resolve the issue.

Published

2 days ago

November 21, 2024

zendzipr

As someone who cares about cybersecurity, I can’t help but feel concerned about the recent news that Ford is investigating allegations of a data breach. A threat actor going by the name ‘EnergyWeaponUser’ claimed on a hacking forum to have leaked 44,000 customer records. They also implicated another hacker, ‘IntelBroker,’ who supposedly took part in the breach back in November 2024.

What’s in the leaked data?

The leaked information includes Ford customer records containing personal details such as full names, physical locations, purchase details, dealer information, and record timestamps. While this data might not be extremely sensitive, it still contains personally identifiable information (PII) that could be used in phishing and social engineering attacks targeting the affected individuals.

What’s interesting is that the threat actors didn’t try to sell the dataset. Instead, they offered it to registered members of the hacker forum for eight credits, equivalent to just a little over $2.

Ford’s response and investigation

We reached out to Ford to validate the claims, and a spokesperson confirmed that they are actively investigating the allegations. They stated, “Ford is aware and is actively investigating the allegations that there has been a breach of Ford data. Our investigation is active and ongoing.”

Is there credibility to these allegations?

The involvement of IntelBroker in the breach lends some credibility to the threat actor’s allegations. This hacker has a track record of confirmed breaches, including recent ones at Cisco’s DevHub portal, Nokia (through a third party), Europol’s EPE web portal, and T-Mobile (via a vendor).

The data samples leaked by the threat actors include locations from around the world, with the United States being one of them.

How to protect yourself from potential risks

In light of this potential data exposure, it’s crucial to treat unsolicited communications with caution and reject requests for revealing more information under any pretense. Keep an eye out for any suspicious emails, messages, or phone calls that might use this leaked information to manipulate or deceive you.

An important update from Ford

After our initial report, Ford provided us with an additional statement based on new findings from their ongoing investigation. They said, “Ford’s investigation has determined that there was no breach of Ford’s systems or customer data. The matter involved a third-party supplier and a small batch of publicly available dealers’ business addresses. It is our understanding that the matter has now been resolved.” – A Ford spokesperson

Stay informed and stay safe

Keeping up to date with cybersecurity news and best practices is crucial in today’s digital world. Continue to check back with us for the latest information and advice on protecting yourself and your data. Remember, knowledge is power, and staying informed is the first step in defending against potential threats.