Malware
Hacker Exposes Massive Giant Tiger Data Breach, Unleashes 2.8M Records Online
A hacker claims to have breached the Canadian retail chain Giant Tiger, leaking 28 million records online, including customers’ personal data. The hacker, known as ‘ZeroTwo’, shared a sample of the stolen data on a popular hacking forum, with details like names, addresses, and phone numbers. Giant Tiger has not yet confirmed the breach.
Canadian retail chain Giant Tiger disclosed a data breach in March 2024.
A threat actor has now publicly claimed responsibility for the data breach and leaked 2.8 million records on a hacker forum that they claim are of Giant Tiger customers.
Data breach monitoring service HaveIBeenPwned has added the leaked database to its website to make it easy for users to check if their information was compromised.
The discount store chain operates over 260 stores and employs 8,000 people across Canada.
2.8 Million Customer Records Leaked Online
On Friday, we noticed a post titled “Giant Tiger Database – Leaked, Download!” surfacing on a hacker forum.
The threat actor behind the post claims to have uploaded the “full” database of Giant Tiger customer records stolen in March 2024.
“In March 2024, the Canadian discount store chain Giant Tiger Stores Limited… suffered a data breach that exposed over 2.8 million clients,” states the threat actor.
“The breach includes over 2.8 million unique email addresses, names, phone numbers, and physical addresses.”
The stolen data in the dump, claims the threat actor, additionally includes the “website activity” of Giant Tiger customers.
“I finally opened 60 of the 60 pages of the database section!” replied one forum member to the post, with others requesting to preview a sample of the data set. The threat actor obliged and posted a small snippet.
The data set has been leaked essentially for free. Although the download link to the set has to be unlocked by spending “8 credits,” such credits are typically trivially generated by forum members by, for example, commenting on existing posts or contributing new posts.
Threat actors often breach companies and steal sensitive data to blackmail them and extort money. Failing successful extortion, a threat actor may deliberately leak the stolen data online or sell it off on dark web marketplaces to buyers interested in conducting identity theft and phishing attacks.
Breach Caused by a Third-Party Vendor
We have not verified the authenticity of the data set, however, we did reach out to Giant Tiger with questions regarding the leak.
Without commenting on the authenticity of the leaked data, a spokesperson responded:
“On March 4, 2024, Giant Tiger became aware of a security concern related to a third-party vendor we use to manage customer communications and engagement,” a Giant Tiger spokesperson told us.
“We determined that contact information belonging to certain Giant Tiger customers was obtained without authorization. We sent notices to all relevant customers informing them of the situation.”
“No payment information or passwords were involved.”
Giant Tiger declined to share the name of the third-party vendor in question.
Records Added to HaveIBeenPwned
As of April 12th, the leaked data set has been added to the “Have I Been Pwned?” database.
HaveIBeenPwned (HIBP) is a free online service that allows users to check if their data was compromised in known data breaches.
The number of breached records associated with this incident added to the HIBP database is 2,842,669, with the service stating that 46% of these records were already in its database.
Giant Tiger customers should be wary of any suspicious emails or incoming communications that claim to be from the retailer. These could very likely be targeted phishing attempts from threat actors.
Although no payment information or passwords were exposed in this breach, signing up for an identity monitoring service could be beneficial to customers in preventing them from becoming victims of identity theft.
To stay informed and protected, keep coming back to learn more about cybersecurity and how it impacts you. Don’t hesitate to contact us if you have any questions or concerns about your online security.
Malware
Phishing Attack Leaves Patients’ Sensitive Data Vulnerable: Urgent Security Alert
Los Angeles County Department of Health Services is investigating a security breach that exposed personal data of over 14,000 patients. The breach was caused by a phishing attack, compromising several employee email accounts and revealing sensitive patient information. Authorities are notifying affected individuals and offering free credit monitoring and identity theft protection services.
Imagine this: you’re a patient in Los Angeles County, home to the most populous county in the United States. You rely on your local hospitals and clinics for your healthcare needs. One day, you receive a letter informing you that your personal and health information has been exposed in a data breach. How would you feel?
A Massive Phishing Attack in L.A. County
This frightening scenario recently unfolded for thousands of patients in L.A. County. The Department of Health Services, which operates the public hospitals and clinics in the area, had to disclose a data breach after a phishing attack impacted over two dozen employees. These mailboxes contained sensitive information for about 6,085 individuals, making this a significant incident.
How Did This Happen?
It all started with a phishing email. A hacker duped 23 employees into clicking a link that appeared to be a legitimate message from a trustworthy source. This simple action gave the attacker access to the employees’ mailboxes, and ultimately, to patients’ personal and health data.
Among the compromised information were patients’ names, dates of birth, home addresses, phone numbers, email addresses, medical record numbers, client identification numbers, dates of service, medical information (such as diagnosis, treatment, test results, and medications), and health plan information. Thankfully, no Social Security Numbers or financial information were exposed in this breach.
Responding to the Breach
Upon discovering the breach, the L.A. County Health Services took swift action. They disabled the impacted email accounts, reset and re-imaged the compromised employees’ devices, and quarantined suspicious incoming emails. The health system also sent out awareness notifications to all employees, reminding them to be vigilant when reviewing emails, especially those containing attachments or links.
In addition, the health system plans to notify the U.S. Department of Health & Human Services’ Office for Civil Rights, the California Department of Public Health, and other relevant agencies about the data breach. While no evidence was found that the attackers accessed or misused the exposed information, L.A. County Health Services advises affected patients to contact their healthcare providers to verify the content and accuracy of their medical records.
A Call to Action: Let’s Protect Our Data Together
This incident serves as a stark reminder of the importance of cybersecurity in the healthcare sector. As patients, we trust our healthcare providers with our most sensitive information, and we must demand that they take every measure to protect it.
As an IT Services company, we understand the challenges healthcare organizations face in safeguarding personal and health information. We encourage you to reach out to us, learn more about our services, and take proactive steps to protect your data. Together, let’s create a safer digital world for all.
Malware
North Korean Cyber Warriors Infiltrate South Korean Defense Contractors: A Chilling Security Breach
North Korean hacking groups Kimsuky and APT37 have targeted South Korean defense contractors, particularly those working on the KF-21 fighter jet. Cybersecurity firm Cybereason has identified spear-phishing campaigns and watering hole attacks used to infiltrate the systems and steal sensitive information. Protect your data from cyber threats with this informative article.
Imagine waking up one day and realizing that your top-secret defense technologies have been stolen by hackers. That’s exactly what happened to several South Korean defense companies recently. So, let’s dive into what happened and how we can learn from these incidents to protect our own sensitive information.
The National Police Agency in South Korea sent out an urgent warning about North Korean hacking groups targeting defense industry entities to steal valuable technology information. These hackers, known as Lazarus, Andariel, and Kimsuky, have successfully breached the defenses of multiple South Korean companies by exploiting vulnerabilities in their networks or those of their subcontractors.
Following a special inspection conducted earlier this year, authorities discovered that some companies had been compromised since late 2022 but were completely unaware of the breach. This highlights the importance of being proactive with cybersecurity measures and staying vigilant for potential threats.
Let’s take a closer look at the attacks
These reports detail three cases involving each of the hacking groups, showing how diverse their attack methods can be when targeting defense technology.
In one case, Lazarus hackers took advantage of poorly managed network connection systems designed for testing. They penetrated the internal networks of a defense company and gathered critical data from at least six of the firm’s computers, transferring it to a cloud server abroad.
The Andariel group’s attack was even more insidious. They stole account information from an employee of a maintenance company that serviced defense subcontractors. Using this stolen account, they installed malware on the servers of these subcontractors, leading to major leaks of defense-related technical data. This situation was made worse by employees using the same passwords for personal and work accounts.
Lastly, Kimsuky hackers exploited a vulnerability in the email server of a defense subcontractor. This allowed them to download and steal substantial technical data from the company’s internal server without authentication.
What can we learn from these incidents?
The Korean police recommend several steps companies can take to protect themselves from similar attacks. These include improving network security segmentation, periodic password resets, setting up two-factor authentication on all critical accounts, and blocking foreign IP accesses.
But let’s take this a step further. As individuals and businesses, we must recognize the importance of safeguarding our sensitive information. This means investing in robust cybersecurity measures, staying informed about potential threats, and taking proactive steps to protect our data.
Don’t wait until it’s too late
These incidents serve as a stark reminder that cyber threats are ever-present and constantly evolving. With an increase in remote work and reliance on digital systems, it’s more important than ever to take cybersecurity seriously. Don’t wait until you’re the next victim – be proactive in protecting your valuable information.
For more information on cybersecurity and how to protect yourself or your business, keep coming back to our IT Services website. We’re here to help you stay informed and secure in an increasingly digital world.
Malware
UnitedHealth Admits Paying Ransomware Gang to Prevent Massive Data Breach
UnitedHealth confirms paying an undisclosed ransom to the Conti ransomware gang to prevent the leak of sensitive patient data. Learn more about the incident and the rise of ransomware attacks on healthcare institutions.
UnitedHealth Group recently confirmed that they had to pay a ransom to cybercriminals to protect sensitive data stolen during a ransomware attack on Optum in late February. This attack wasn’t just any ordinary cybercrime; it led to a massive outage that affected Change Healthcare payment systems, impacting several critical services used by healthcare providers and pharmacies throughout the U.S. These services included payment processing, prescription writing, and insurance claims.
Can you believe that the organization reported $872 million in financial damages from this single cyberattack? It’s mind-boggling! But it doesn’t stop there. The BlackCat/ALPHV ransomware gang claimed responsibility for the attack, alleging that they stole 6TB of sensitive patient data. And in early March, they even pulled off an exit scam after allegedly receiving $22 million in ransom from UnitedHealth.
During that time, one of the gang’s affiliates, known as “Notchy,” claimed they had UnitedHealth data because they conducted the attack and that BlackCat cheated them out of the ransom payment. The transaction was visible on the Bitcoin blockchain, and researchers confirmed it reached a wallet used by BlackCat hackers.
As if things couldn’t get more complicated, a week later, the U.S. government launched an investigation into whether health data had been stolen in the ransomware attack at Optum. And by mid-April, the extortion group RansomHub raised the stakes even higher for UnitedHealth by starting to leak what they claimed to be corporate and patient data stolen during the attack. UnitedHealth’s patient data reached RansomHub after “Notchy” partnered with them to extort the company again.
Data stolen, ransom paid
In a statement, UnitedHealth confirmed that they paid a ransom to prevent patient data from being sold to cybercriminals or leaked publicly. The company said, “A ransom was paid as part of the company’s commitment to do all it could to protect patient data from disclosure.”
We checked RansomHub’s data leak website and can confirm that the threat actor has removed UnitedHealth from its list of victims. UnitedHealth’s removal from RansomHub’s site may indicate that today’s confirmation is for a payment to the new ransomware gang rather than the alleged $22 million payment to BlackCat in March.
Recently, UnitedHealth posted an update on its website announcing support for people whose data had been exposed by the February ransomware attack, officially confirming the data breach incident. The company stated that based on initial targeted data sampling, they have found files containing protected health information (PHI) or personally identifiable information (PII). This could potentially affect a substantial proportion of people in America. However, the company reassures patients that they have not seen evidence of exfiltration of materials such as doctors’ charts or full medical histories among the data.
UnitedHealth further explained that only 22 screenshots of stolen files, some containing personally identifiable information, were posted on the dark web, and that no other data exfiltrated in the attack has been published “at this time.” The organization has promised to send personalized notifications once it completes its investigation into the type of information compromised.
As part of its efforts to support those impacted, UnitedHealth has set up a dedicated call center offering two years of free credit monitoring and identity theft protection services. Currently, 99% of the impacted services are operational, medical claims flow at near-normal levels, and payment processing stands at approximately 86%.
A call for action: Protect yourself and your organization
UnitedHealth’s experience is a sobering reminder of the ever-present threat of cyberattacks and the importance of taking cybersecurity seriously. Don’t let your organization become the next victim. Reach out to us, and together, we’ll help you stay one step ahead of cybercriminals. Keep coming back to learn more about the latest cybersecurity trends and best practices to safeguard your valuable data.
-
Malware7 months ago
Flagstar Bank’s Latest Data Breach: 800,000 Customers Impacted, Marking the Third Incident of 2021
-
Malware7 months ago
Blackbaud: Taking Responsibility with a Landmark $49.5 Million Settlement for Devastating Ransomware Data Breach
-
Data Protection Regulations5 months ago
Top Data Protection Officer Certification Courses Reviewed
-
Security Audits and Assessments5 months ago
Mastering Healthcare Data Security: 5 Essential Audit Tips
-
Security Audits and Assessments5 months ago
HIPAA Security Risk Assessment: Essential Steps Checklist
-
Data Protection Regulations5 months ago
Top 11 Data Protection Training Programs for Compliance
-
Data Protection Regulations5 months ago
9 Best Insights: CCPA’s Influence on Data Security
-
Data Protection Regulations5 months ago
Navigating Data Protection Laws for Nonprofits