Hackmanac Cyber Alerts

🚨Cyberattack Alert ‼️ 🇪🇸Spain - INDIBA Group Cicada3301 hacking group claims to have breached INDIBA Group. Allegedly, 33 GB of data were exfiltrated, including accounting records, financial information, employee and client data, as well as photos, videos, scans, technical documents, data related to competitors and partners and so on.

🚨Cyberattack Alert ‼️ 🇲🇽Mexico - OMA Grupo Aeroportuario del Centro Norte, S.A.B. de C.V. (OMA) has identified a recent cybersecurity incident involving unauthorized access to certain information systems. OMA's operations are currently running on backup and alternative systems, and as of now, there has been no material adverse impact on their operations, financial results, or financial position. A forensic evaluation is underway to fully assess the impact of the cybersecurity breach. Source: https://www.oma.aero/assets/005/6312.pdf

🚨ESET partner breached to send data wipers to Israeli orgs 🚨 https://www.bleepingcomputer.com/news/security/eset-partner-breached-to-send-data-wipers-to-israeli-orgs/

🚨Cyberattack Update - Polar Polar, a leading maker of heart rate monitors and running watches, experienced a cybersecurity attack on October 11, 2024, leading to the shutdown of its login and signup pages. Polar has assured users that their health data, including data from the Polar Flow platform, has not been compromised. However, the attack did affect some customer order information from Polar's US online store. Preliminary reports indicate that only a small portion of customers' accounts were impacted. More details: https://www.techradar.com/health-fitness/polar-says-your-health-data-is-safe-following-cybersecurity-attack

🚨Data Breach Alert ‼️ 🇬🇧UK - Lycamobile A potential data breach at Lycamobile has been detected on a hacking forum: 1.5M users reportedly affected. According to the post, the data includes information such as full name, email address, full credit card information, postcode, and cardholder address. The threat actor provided a sample with 644 customer records and is demanding a ransom of $30,000 to delete the data. The confirmation or denial of these claims has yet to be verified.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Neighbors Credit Union Black Suit ransomware group claims to have breached Neighbors Credit Union. All the exfiltrated data has been completely leaked.

🚨Cyberattack Alert ‼️ 🇮🇹Italy - Municipality of Aversa On October 17, 2024, the mayor of Aversa, Francesco Matacena, reported a cyberattack targeting the municipality's servers, which had been down since Monday. The attack resulted in the deletion of data from various municipal offices, including public works, general affairs, and citizen services. More details: https://casertace.net/attacco-informatico-al-comune-di-aversa-la-denuncia-del-sindaco/

🚨 Radiant Capital Hacked: Over $55M Stolen 🚨 On the evening of October 16, Radiant Capital fell victim to a hacking attack. Preliminary reports estimate that over $51.5 million worth of digital assets were stolen, with the total damage now approaching $55 million and still growing. 🔗 Targeted blockchains: - Binance Smart Chain - Arbitrum One A significant portion of the stolen funds was converted into native tokens such as BNB and ETH. The stolen assets are currently held in several cryptocurrency addresses, with the main ones being: 💸 Stolen funds held in: - 0x8B75E47976C3C500D0148463931717001F620887 – $33.8M - 0xcF47c058CC4818CE90f9315B478EB2f2d588Cc78 – $19.2M - 0x911215CF312a64C128817Af3c24B9fDF66B7Ac95 – $0.76M - 0x0629b1048298AE9deff0F4100A31967Fb3f98962 – $0.48M 💻 Hacker addresses identified: - 0xc24927Bd40Bab67CcfB2ca0A90d6cbB8Edb21302 - 0x579145D6d1F26a460d9BDD3040C37517dac379ac 🔍 The hackers used various hosting and VPN services. However, analysis indicates that the attackers may be linked to the CIS region, with preparations for the attack starting on September 23. We are closely monitoring the situation and tracking the hackers' actions as they attempt to launder the stolen funds. 👋 Match Systems

🚨Cyberattack Alert ‼️ 🇦🇺Australia - Ultra Tune Fog hacking group claims to have breached Ultra Tune, one of the country's most recognised and trusted car service brands. Allegedly, 3 GB of data were exfiltrated, including human resources records, personal employee data, customer contacts, internal company information, driver licenses, passports, and medical certificates.

🚨Cyberattack - 'Death to Israel' Displayed Across Chicago After Hackers Change Billboards On October 16, 2024, hackers compromised several electronic billboards in Northbrook, a suburb of Chicago, displaying messages such as "Death to Israel" and "F* Israel" alongside the Palestinian flag. One of the billboards falsely claimed to be paid for by YouTuber MrBeast, with an image of his face. The messages appeared around 5:30 p.m. and were removed by 7 p.m. after being reported. MrBeast's representatives denied any involvement, and both Outfront Media, the billboard company, and local authorities are investigating the attack. More details: https://www.newsweek.com/death-israel-displayed-across-chicago-after-hackers-change-billboards-1970449

🚨Data Breach Alert ‼️ 🇺🇸USA - The Texas Department of Public Safety (DPS) has reported a data breach affecting the personal information of 115,071 Texans. The leaked data includes names, addresses, Social Security numbers, driver's license numbers, and government-issued ID numbers. More details: https://www.houstonpublicmedia.org/articles/news/public-safety/2024/10/16/503095/personal-information-for-more-than-115000-texans-leaked-in-dps-data-breach/

🚨Cyberattack Alert ‼️ 🇦🇪UAE - Al Qaryah Auctions RansomHub hacking group claims to have breached Al Qaryah Auctions. Allegedly, 100 GB of data were exfiltrated, including personal identifiable information (PII), financial information, and confidential business information. Ransom deadline: 24th Oct 24.

🚨EigenLayer X account compromised, shares malicious airdrop link🚨 Do not click any links More details: https://cointelegraph.com/news/eigenlayer-x-account-compromised-malicious-airdrop-link

🚨Cyberattack Update ‼️ 🇯🇵Japan - Nidec Corporation Confirms Cyberattack On August 5, 2024, NIDEK Precision (Vietnam) Co., Ltd. (NPCV), a subsidiary of NIDEK Precision, was targeted by an external criminal group, resulting in a data breach. The attackers illegally accessed NPCV’s server, stealing over 50,000 documents and demanding a ransom. When the company did not comply, the stolen data, which included internal documents, contracts, and supplier letters, was published on a dark website, making it accessible to third parties. The attack exploited a compromised user ID and password to access the NPCV server via VPN. No secondary economic damage has been confirmed, and there have been no additional attacks since the initial breach. The company has taken immediate action, including suspending VPN operations, resetting passwords, and conducting system-wide scans to prevent further intrusions. Source: https://www.nidec.com/jp/nidec-precision/corporate/news/2024%E5%B9%B4/20241017%20incident2/

🚨Cyberattack Alert ‼️ 🇯🇵Japan - Yorozu Corporation (株式会社ヨロズ) On October 14, 2024, Yorozu Corporation confirmed a ransomware attack that encrypted files stored on multiple servers, making them inaccessible. The company immediately formed a task force and isolated the affected servers from both the internet and internal networks. Yorozu Corporation has apologized to its business partners for the inconvenience and has committed to promptly disclose any further developments. Source: https://www.yorozu-corp.co.jp/share/uploads/2024/10/Notice-of-Ransomware-Attack-Incident2024.10.18.pdf

🚨Data Leak Alert - Black Lives Matter A potential data leak involving details of Black Lives Matter (BLM) users has been detected on a hacking forum. The threat actor has leaked thousands of credit card details. The provided file includes full credit card details (card type, card number, expiry date, and CVV, full name of the owner) and physical addresses of people who donated to BLM or purchased something from store.blacklivesmatter[.]com. Additionally, the threat actor claims to have conducted a "massive" scrape from Blacklivesmatter[.]com, which includes emails, names, phone numbers, passwords, and URLs. The confirmation or denial of these claims has yet to be verified.

🚨Cyberattack Alert ‼️ 🇺🇸USA - CreaGen Biosciences Everest hacking group claims to have breached CreaGen Biosciences. Ransom deadline: 28th Oct 24.

🚨Cyberattack Alert ‼️ 🇵🇷Puerto Rico - Puerto Rican Institute of Culture RansomHub hacking group claims to have breached the Puerto Rican Institute of Culture. Allegedly, 95 GB of data were exfiltrated. Ransom deadline: 24th Oct 24.

🚨Cyberattack Alert ‼️ 🇮🇳India - tripXOXO Kill Security hacking group claims to have breached tripXOXO, the Asia's largest marketplace for booking activities. Allegedly, exfiltrated data include full names, passport numbers, email addresses, phone numbers, travel booking details (including booking IDs and supplier references), and health insurance coverage details including policy numbers and sums insured. Ransom deadline: 26th Oct 24.

For those who missed it, USDoD, the hacker known for the breach of National Public Data, has been arrested in Brazil. https://g1.globo.com/politica/noticia/2024/10/16/pf-prende-hacker-de-33-anos-suspeito-de-invadir-sistemas-e-vazar-dados-de-policiais.ghtml