At a glance.
- Hacker dumps data allegedly stolen from TransUnion.
- Another MOVEit-related breach announced.
Hacker dumps data allegedly stolen from TransUnion.
Security Affairs reports that a hacker who goes by the handle USDoD (no relation to the US Department of Defense) claims to have infiltrated the systems of US credit reporting agency TransUnion and obtained the information of 58,505 customers in America and Europe. According to cybercrime tracker Vx-Underground, USDoD published 3 gigabytes of TransUnion data, and it includes sensitive info like customers’ full names, credit scores, passport details, and loan balances. TransUnion has yet to confirm the attack. In a post on the cybercriminal forum BreachForums, the hacker says the operation was carried out with help from new cyber extortion gang Ransomed.
The group’s modus operandi is to demand a ransom from victims in exchange for not talking to data protection regulators about their ineffective cybersecurity. As Gov Info Security notes, this isn’t USDoD’s first rodeo; last year he also claimed responsibility for an attack targeting the US Federal Bureau of Investigation’s public-private cybersecurity forum Infragard, and most recently he breached the systems at aerospace giant Airbus. The hacker’s identity is unclear, but during an interview with DataBreaches.net over the weekend, he made it clear what he’s not: "I Am Not Pro-Russia, and I Am NOT a Terrorist, Either!" he stated. (Good to know...we suppose.)
Chad McDonald, CISO at Radiant Logic, argues that prevention is better than reaction. “The attack on TransUnion is a reminder that businesses must be taking proactive measures to stop breaches before they occur. It’s easy for enterprises to struggle with their identity data, whether it’s identity silos, duplicates or anomalies – a lack of identity visibility and management can lead to inappropriate or outdated access to a business’s resources. By taking an identity-first security approach and consolidating identity data into a single, hardened data store, data breaches and leaks can be avoided from both outsider and insider threats.”
Another MOVEit-related breach announced.
Cadence Bank, a financial services institution based in the US state of Mississippi, has disclosed it suffered a data breach linked to the mass-hack of the MOVEit file transfer app. According to a filing with the Attorney General of Montana, the bank learned of the MOVEit bug on June 1 and responded by installing the necessary patches and conducting an investigation to determine whether its systems had been impacted before remediation had occurred. By June 18, the bank determined that an unauthorized party had gained access to private customer info including names, addresses, dates of birth, Social Security numbers, driver’s license numbers, and financial account information. JUDSupra adds that the bank began notifying affected individuals last week.
