AT&T reportedly paid a hacker $373,000 to delete stolen customer records.

Summary

By the CyberWire staff

At a glance.

AT&T reportedly paid a hacker $373,000 to delete stolen customer records.
Rite Aid discloses ransomware attack.
CDK Global allegedly paid a $25 million ransom to restore systems.
Cybercriminals claim to have breached Disney's Slack.

AT&T reportedly paid a hacker $373,000 to delete stolen customer records.

WIRED reports that AT&T paid a hacker approximately $373,000 worth of Bitcoin to delete a trove of customer data stolen from the company's Snowflake cloud storage account. AT&T disclosed last week that the stolen data included phone call and text message records from nearly every AT&T customer (approximately 109 million people) between May and October of 2022. A security researcher who assisted AT&T told WIRED he believes the only copy of the data was deleted, although there's no way to know for certain that the hacker didn't keep a duplicate.

Putting the “I” in CDR: Does your cloud security meet the /555 Benchmark?

An attack can execute in the cloud in as little as 10 minutes. Security teams must accelerate cloud investigation to combat these fast-moving threats. But how? Tune in to our on-demand webinar to hear from cloud security experts - firsthand - as they discuss the industry’s ONLY cloud security benchmark (/555) and why it’s critical to achieve this milestone for cloud detection and response. Further, learn methods to streamline investigations and reduce manual effort for your SecOps team! Watch now!

Rite Aid discloses ransomware attack.

US pharmacy giant Rite Aid sustained a ransomware attack last month that led to a breach of some customer data, BleepingComputer reports. The company said in a statement, "Rite Aid experienced a limited cybersecurity incident in June, and we are finalizing our investigation. We take our obligation to safeguard personal information very seriously, and this incident has been a top priority. Together with our third-party cybersecurity partner experts, we have restored our systems and are fully operational. We are sending notices to impacted consumers."

Rite Aid didn't disclose what type of customer data was affected, but said it didn't involve health or financial information. BleepingComputer notes that the RansomHub gang claimed responsibility for the attack and stole 10 GB of customer information, including "name, address, dl_id number, dob, [and] riteaid rewards number."

Attention all security professionals! Want real-time IP intelligence at your fingertips?

Sign up for Scout Insight's free trial today! Get immediate insights into threats, search any IP with no training required, and enjoy intuitive graphical results. Whether you need to identify compromised hosts or enrich Splunk queries, Scout Insight has you covered. Don’t wait – accelerate your threat response now. Visit team-cymru.com/cyberwire to start your free trial!

CDK Global allegedly paid a $25 million ransom to restore systems.

Car dealership software provider CDK Global allegedly paid a $25 million ransom following a ransomware attack the company sustained in June, CNN reports. Crypto forensics firm TRM Labs told CNN that 387 bitcoins were paid to an account belonging to BlackSuit, the ransomware gang that hit CDK. The money was paid by a firm that helps companies handle ransomware demands. A week after the payment was made, CDK began restoring its systems. CNN cites three anonymous sources as saying that "CDK was very likely the source of that payment." CDK Global hasn't commented on the report.

Cybercriminals claim to have breached Disney's Slack.

A cybercriminal group known as "NullBulge" claims to have stolen more than a terabyte of data from Disney's internal Slack channels, Malwarebytes reports. NullBulge presents itself as a hacktivist group working for better compensation and protection of artists' rights. The group claimed in a post on BreachForums to have stolen "Unreleased projects, raw images and code, some logins, links to internal api/web pages, and more."

Modernize Your Identity Systems with Ease.

Identity architects and engineers, Strata helps you integrate legacy apps with any IDP, ensuring seamless identity failover and applying MFA without touching app code. Reduce tech debt and enhance security with Strata's robust identity orchestration solution. Share your biggest identity challenge and receive a pair of complimentary AirPods Pro.

Notes.

Today's issue includes events affecting Russia, Ukraine, and the United States.

Attacks, Threats, and Vulnerabilities

Indiana county files disaster declaration following ransomware attack (The Record) Multiple governments across the U.S. are dealing with the after effects of ransomware attacks — with one issuing a disaster declaration after services were knocked offline.

Hackers use PoC exploits in attacks 22 minutes after release (BleepingComputer) Threat actors are quick to weaponize available proof-of-concept (PoC) exploits in actual attacks, sometimes as quickly as 22 minutes after exploits are made publicly available.

HardBit ransomware version 4.0 supports new obfuscation techniques (Security Affairs) Cybersecurity researchers detailed a new version of the HardBit ransomware that supports new obfuscation techniques to avoid detection.

Malicious Python packages found exfiltrating user data to Telegram bot (Computing) Researchers at security vendor Checkmarx have uncovered an operation, apparently based in Iraq, that uses malware hosted on the Python repository PyPI to search for files on the victim's device and exfiltrate them to a Telegram bot.

Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data (Hackread) Follow us on Twitter (X) @Hackread - Facebook @ /Hackread

Marketplace

Google is reportedly planning its biggest startup acquisition ever (The Verge) Google continues jockeying for the Microsoft Azure crown.

Litigation, Investigation, and Law Enforcement

Russian student sentenced to 5 years for collecting sensitive military data for Ukraine’s security services (The Record) A Russian student was found guilty Thursday of passing the locations of Russian troops to Ukraine’s security service (SBU), and was sentenced to five years in a maximum security colony.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Cybersecurity in Congress - Hosted by Women in Cyber (Virtual, Jul 25, 2024) Welcome to our online event where we'll be discussing all things cybersecurity in Congress! Join us for insightful discussions, engaging panels, and networking opportunities with fellow cybersecurity enthusiasts. Whether you're a seasoned professional or just starting out in the field, this event is perfect for anyone interested in the intersection of cybersecurity and government. Don't miss out on this unique opportunity to learn from industry experts and connect with like-minded individuals. Register now and secure your spot!

Events

SANSFIRE Washington, DC 2024 (Washington (or virtual), DC, USA, Jul 15 - 20, 2024) At SANSFIRE Washington, DC 2024, choose from 48 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SecureWorld Artificial Intelligence Virtual Conference (Virtual, Jul 24, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

Insider Risk Management Program Evaluation & Optimization Training Course (Laurel, Maryland, USA, Jul 29 - 30, 2024) This highly sought after and very comprehensive training course, will ensure that the Insider RIsk Program Manager / Insider Threat Program (ITP) Manager and other key stakeholders that support the ITP, have the Core / Advanced Knowledge, Blueprint, Resources needed for developing, managing or optimizing a program. Students will be provided with an ITP Management Toolkit that provides an abundance of educational resources, templates and checklists for ITP development, management and optimization. Our student satisfaction levels are in the exceptional range. The Insider Threat Defense Group is so confident about our training courses that they come with a money back training guarantee.

SecureWorld Manufacturing & Retail Virtual Conference (Virtual, Aug 28, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 07.15.24

At a glance.

AT&T reportedly paid a hacker $373,000 to delete stolen customer records.

Rite Aid discloses ransomware attack.

CDK Global allegedly paid a $25 million ransom to restore systems.

Cybercriminals claim to have breached Disney's Slack.

Notes.

Attacks, Threats, and Vulnerabilities

Marketplace

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events