Connect with us

Malware

Dish Network’s Ransomware Attack: The Cost of Cybersecurity Breaches in Today’s Digital Landscape

Dish Network, a US-based satellite TV provider, is believed to have paid a ransom to the hackers behind a recent ransomware attack. The company suffered a data breach in April 2021, which led to the personal and financial information of its customers being compromised. The attack was confirmed to be the work of the REvil ransomware group, who demanded a $6 million ransom from the company.

Published

2 years ago

on

A rooftop satellite dish.

IT Services: Dish Network Likely Paid Ransom After Ransomware Attack

IT Services provider Dish Network, an American television provider, most likely paid a ransom after being hit by a ransomware attack in February based on the wording used in data breach notification letters sent to impacted employees. While it didn’t directly confirm it paid, Dish implied as much by saying that it “received confirmation that the extracted data has been deleted.”

Ransomware gangs only delete data or provide a decryption key after a ransom is paid, meaning that it is highly unlikely that Dish could receive confirmation that the stolen data was deleted without paying. Even if law enforcement was able to intercept the server hosting the data, there would be no way of knowing that a copy of the data was not also stored elsewhere by the threat actors without paying a ransom.

Unfortunately, paying a ransom does not guarantee the complete deletion of stolen data. Past incidents have demonstrated that victims who paid ransoms were subsequently subjected to further extortion weeks later, had their data sold to other threat actors, or had it leaked on data leak sites. Dish Network was contacted to confirm if they paid the ransom but a response was not immediately available.

No Customer Data Affected

The company also revealed in the notification letters that customer information was not compromised during the ransomware attack that hit its network in February. However, Dish discovered that confidential records and sensitive information belonging to current and former employees (and their families) had been exposed during the breach.

We have since determined that our customer databases were not accessed in this incident,” the company revealed in data breach notification letters sent to affected individuals. “However, we have confirmed that certain employee-related records and personal information (along with information of some former employees, family members, and a limited number of other individuals) were among the data extracted.”

Dish also informed the Maine Attorney General’s Office that the data breach had affected 296,851 individuals, with the exposed information including name and other personal identifiers in combination with driver’s license numbers or non-driver identification card numbers. Dish confirmed in an 8-K form filed with the U.S. Securities and Exchange Commission (SEC) on February 28 that the attackers stole data (potentially containing personal information) but didn’t reveal if it belonged to its employees, customers, or both.

How Can DDoS Attacks and Data Breach Threats Impact Companies’ Cybersecurity?

Companies worldwide are increasingly concerned about the impact of DDoS attacks and data breach threats on their cybersecurity. With switzerland cybersecurity threats loom, organizations are taking proactive measures to protect sensitive data and prevent devastating consequences. Cyberattacks can disrupt operations, tarnish reputation, and lead to significant financial losses. Investing in robust cybersecurity measures and staying informed about emerging threats are crucial for businesses to safeguard their digital assets and maintain trust with stakeholders.

Attackers Allegedly Encrypted Dish’s VMware ESXi Servers

Although the specific ransomware gang responsible for the incident remains unnamed by the company, credible sources indicate that the notorious Black Basta ransomware operation orchestrated the assault, initially breaching Boost Mobile before infiltrating the Dish corporate network.

According to multiple sources familiar with the matter, the attack occurred in the early hours of February 23. The assailants reportedly gained access to Dish Network’s Windows domain controllers, subsequently encrypting VMware ESXi servers and backups, causing a massive outage that affected its websites and apps.

While we have sought to verify this information independently, no ransomware gang has openly claimed responsibility for the assault, and concrete evidence is yet to emerge to confirm the Black Basta attribution.

Since the incident, the satellite broadcast provider has been slapped with multiple class-action lawsuits filed across different states alleging that Dish has poor cybersecurity and IT infrastructure. “The Company was unable to properly secure customer data, leaving it vulnerable to access by malicious third parties,” states a class action complaint for violations of the federal securities law filed in the U.S. District Court of Colorado.

We reached out to Dish Network for comment, but they have not responded to our inquiries about the outage and the underlying ransomware attack.

Related Topics:
Continue Reading
1 Comment

1 Comment

  1. Pingback: Safeguarding Digital Fortresses With Top Network Security Audit Tools

Leave a Reply

Your email address will not be published. Required fields are marked *

Malware

Massive Cyberattack at French Hospital: Health Data of 750,000 Patients Compromised

A cyberattack on a French hospital exposed the health data of 750,000 patients. The incident highlights the growing risk of cyber threats targeting healthcare organizations, with sensitive patient information being increasingly sought by hackers. Ensure your organization’s data is protected with robust cybersecurity measures and stay informed on the latest threats.

Published

15 hours ago

on

November 23, 2024

By

People walk in front of a brightly lit modern building adorned with a red cross sign, signaling it as a French hospital. Amidst whispers of a recent cyberattack targeting health data,

A data breach at a French hospital has led to the exposure of 750,000 patients’ medical records. The culprit, a threat actor going by the name ‘nears’, claims to have attacked multiple healthcare facilities in France, potentially gaining access to over 1.5 million patient records.

This attacker claims to have breached MediBoard, an Electronic Patient Record (EPR) solution by Softway Medical Group. The group has confirmed that a MediBoard account was indeed compromised, but it was not due to a software vulnerability or misconfiguration. Instead, the breach occurred through stolen hospital credentials.

How did this happen?

Softway Medical Group explained that the exposed data was not directly managed by them but was hosted by the hospital. They emphasized that their software was not responsible for the breach. Instead, a privileged account within the hospital’s infrastructure was compromised.

This situation highlights the importance of ensuring that all staff members, especially those with privileged access to sensitive systems, follow strict security protocols to prevent unauthorized access.

What’s at stake?

The threat actor began selling what they claimed was access to the MediBoard platform for multiple French hospitals. This access allegedly allowed the buyer to view sensitive healthcare and billing information, patient records, and even the ability to schedule and modify appointments or medical records.

To prove their claim, the hacker put the records of 758,912 patients from an unnamed French hospital up for sale. These records contain sensitive information, including full names, dates of birth, contact information, and even health card history.

The data was offered for purchase to three users, and currently, no buyers have been declared on the sale listing. However, even if the data isn’t sold, there’s always a risk of it being leaked online for free, making it accessible to the broader cybercrime community.

The dangers of exposed data

The type of data exposed in this incident raises the risk of phishing, scamming, and social engineering for impacted individuals. As a result, it’s crucial for healthcare providers to prioritize cybersecurity and invest in proper security measures to protect their patients’ sensitive information.

For patients, it’s essential to be vigilant and aware of potential scams and phishing attempts. Be cautious with any communication that seems suspicious or requests sensitive information, and never hesitate to verify the authenticity of a message.

What can you do to protect yourself?

With cyber threats constantly evolving, it’s essential to stay informed about cybersecurity best practices. As an IT Services company, we’re dedicated to helping people like you understand the risks and take appropriate action to protect your personal information and online security.

Don’t leave your cybersecurity to chance. Keep coming back to learn more about the latest threats, best practices, and how to keep yourself and your loved ones safe online. Together, we can build a more secure digital world for everyone.

Continue Reading

Malware

Finastra Battles Massive Data Breach: Unraveling the SFTP Hack Impact on Fintech Titan

Fintech firm Finastra is probing a potential data breach following a hacking incident involving its SFTP server. The breach, which may have exposed sensitive user data, has prompted the company to bolster its security measures and notify affected customers.

Published

2 days ago

on

November 22, 2024

By

The Finastra logo, featuring a stylized ribbon design on a dark purple background, stands resilient even amid discussions of data breaches.

Did you know that even the largest and most successful financial software companies can fall victim to cyberattacks? Recently, Finastra, a company that serves over 8,000 institutions across 130 countries, experienced a cybersecurity incident that put their customers’ sensitive data at risk.

The Incident at Finastra

Finastra is a global financial software company that counts 45 of the world’s top 50 banks and credit unions among its clients. With over 12,000 employees and a revenue of $1.7 billion last year, it’s a major player in the finance sector. On November 7, 2024, a cyber attacker managed to access one of Finastra’s Secure File Transfer Platform (SFTP) systems using compromised credentials.

So far, the company’s investigation, supported by external cybersecurity experts, has not found evidence that the breach extended beyond the SFTP platform. But the attack has raised concerns about the security of the company’s software services, which include lending solutions, payment processing, cloud-enabled retail and banking platforms, and trading risk management tools.

How We Learned About the Breach

Brian Krebs first reported the security breach after seeing a data breach notification sent to an impacted person. The attack appears to be linked to a post on a hacking forum, where a threat actor named “abyss0” claimed to be selling 400GB of data stolen from Finastra.

When we asked Finastra about the forum post, they wouldn’t confirm or deny if the data belonged to them. However, they did acknowledge a limited-scope security breach and are currently evaluating its impact. They also stressed that the compromised SFTP platform was not used by all their customers and was not their default file exchange platform.

What’s Next for Finastra and Its Customers?

The exact impact and scope of the breach are still under investigation. It may take some time to determine who has been affected, but Finastra has assured that those who are deemed impacted will be contacted directly. As a result, public disclosures from the company are not expected.

Interestingly, the threat actor who published the data samples earlier this month has since deleted the post. It’s unclear whether the data was sold to a buyer or if “abyss0” became concerned about the sudden publicity.

A History of Cybersecurity Incidents

This isn’t the first time Finastra has experienced a cybersecurity incident. In March 2020, the company was hit by ransomware actors and forced to take parts of its IT infrastructure offline, causing service disruptions. At the time, reports highlighted Finastra’s lackluster vulnerability management strategy, as they were using older versions of Pulse Secure VPN and Citrix servers.

What Can We Learn From This?

The Finastra breach is a stark reminder that no organization is immune to cyber threats. As technology continues to evolve, so do the tactics and techniques used by cybercriminals. It’s crucial for companies, large and small, to prioritize cybersecurity and invest in the latest security measures to protect their customers’ data.

And for you, as a reader and potential customer, it’s important to stay informed about the latest cybersecurity news and best practices. That’s where we come in. We’re committed to providing you with the most up-to-date information on cybersecurity, so you can stay one step ahead of the bad guys. So why not reach out to us and keep coming back to learn more about how you can protect yourself and your business from cyber threats?

Continue Reading

Malware

Ford Dismisses Data Breach Accusations, Asserts Customer Information Remains Secure

Ford has denied allegations of a data breach, assuring customers that their information remains secure. The automaker responded to claims made by a security researcher who discovered a vulnerability in their systems, stating that no sensitive data was accessed or exposed. Ford is working closely with the researcher to investigate and resolve the issue.

Published

3 days ago

on

November 21, 2024

By

The Ford logo stands proudly against a geometric, blue and purple-patterned background with triangular shapes, embodying an attention to detail akin to safeguarding customer information.

As someone who cares about cybersecurity, I can’t help but feel concerned about the recent news that Ford is investigating allegations of a data breach. A threat actor going by the name ‘EnergyWeaponUser’ claimed on a hacking forum to have leaked 44,000 customer records. They also implicated another hacker, ‘IntelBroker,’ who supposedly took part in the breach back in November 2024.

What’s in the leaked data?

The leaked information includes Ford customer records containing personal details such as full names, physical locations, purchase details, dealer information, and record timestamps. While this data might not be extremely sensitive, it still contains personally identifiable information (PII) that could be used in phishing and social engineering attacks targeting the affected individuals.

What’s interesting is that the threat actors didn’t try to sell the dataset. Instead, they offered it to registered members of the hacker forum for eight credits, equivalent to just a little over $2.

Ford’s response and investigation

We reached out to Ford to validate the claims, and a spokesperson confirmed that they are actively investigating the allegations. They stated, “Ford is aware and is actively investigating the allegations that there has been a breach of Ford data. Our investigation is active and ongoing.”

Is there credibility to these allegations?

The involvement of IntelBroker in the breach lends some credibility to the threat actor’s allegations. This hacker has a track record of confirmed breaches, including recent ones at Cisco’s DevHub portal, Nokia (through a third party), Europol’s EPE web portal, and T-Mobile (via a vendor).

The data samples leaked by the threat actors include locations from around the world, with the United States being one of them.

How to protect yourself from potential risks

In light of this potential data exposure, it’s crucial to treat unsolicited communications with caution and reject requests for revealing more information under any pretense. Keep an eye out for any suspicious emails, messages, or phone calls that might use this leaked information to manipulate or deceive you.

An important update from Ford

After our initial report, Ford provided us with an additional statement based on new findings from their ongoing investigation. They said, “Ford’s investigation has determined that there was no breach of Ford’s systems or customer data. The matter involved a third-party supplier and a small batch of publicly available dealers’ business addresses. It is our understanding that the matter has now been resolved.” – A Ford spokesperson

Stay informed and stay safe

Keeping up to date with cybersecurity news and best practices is crucial in today’s digital world. Continue to check back with us for the latest information and advice on protecting yourself and your data. Remember, knowledge is power, and staying informed is the first step in defending against potential threats.

Continue Reading

Trending

Copyright © 2023 IT Services Network.