Hackmanac Cyber Alerts

🚨Cyberattack Alert‼️ 🇯🇵🇺🇸 - Mizuno The BianLian ransomware group claims to have breached the USA branch of Mizuno. Allegedly, exfiltrated data include financial data, HR records, contracts and confidential agreements, partner and vendor information, client and customer data, drawings, trade secrets and patents, as well as mailboxes and internal and external email correspondence.

🚨Cyberattack 🚨 🇯🇵Japan - HAKUTEN (博展) HAKUTEN has temporarily suspended access to its corporate website due to detected unauthorized access to its server. The company apologizes for the inconvenience caused to customers, partners, and stakeholders. The investor relations (IR) site remains accessible as it is hosted on a separate server unaffected by the incident. Source: https://ir.hakuten.co.jp/

🚨Cyberattack Alert ‼️ 🇸🇦Saudi Arabia - Oxyhealth Clinics Kill Security hacking group claims to have breached Oxyhealth Clinics. Allegedly, exfiltrated data include patients' personally identifiable information (PII) and electronic health records (EHR). Ransom deadline: 18th Nov 24.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Granite School District The Rhysida ransomware group claims to have breached Granite School District and is demanding a ransom of 20 BTC (approx. $1,500,000) to be paid by Nov 16, 2024.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Healthcare Management Systems BianLian ransomware group claims to have breached Healthcare Management Systems. Allegedly, exfiltrated data include the company’s and clients’ financial and HR data, QuickBooks data, PII and PHI records, business contracts and agreements, company clients' patient records, as well as mailboxes and email correspondence.

🚨Cyberattack Alert ‼️ 🇲🇳Mongolia - Intermed Hospital Space Bears hacking group claims to have breached Intermed Hospital. Allegedly, exfiltrated data include databases, personal data, and other valuable information. Ransom deadline: 15th Nov 24.

🚨Data Breach Alert 🚨 🇬🇧UK - FINASTRA A potential data breach at Finastra, one of the largest fintech companies in the world, has been detected on a hacking forum. According to the post, a bad actor using the moniker "abyss0" claimed that in November, Finastra suffered a data breach resulting in the theft of 400 GB (compressed) of data. This data is allegedly from their ESB and was exfiltrated via IBM Aspera. Samples of the data have been provided. The confirmation or denial of these claims has yet to be verified.

🚨Cyberattack Alert ‼️ 🇦🇪UAE - Nejoum Al Jazeera Dark Vault hacking group claims to have breached Nejoum Al Jazeera. Ransom deadline: 14th Nov 24.

🚨Cyberattack Alert ‼️ 🇧🇷Brazil - Marisa S.A. Medusa ransomware group claims responsibility for the attack on Marisa S.A. and is demanding a ransom of $300,000 to be paid by November 18, 2024. As we previously reported, Marisa reported on November 5 that a cyberattack temporarily disrupted parts of its systems.

🚨Data Breach Update 🚨 NOKIA Today, IntelBroker has released for free the previously alleged data from a breach involving a third party associated with Nokia, following Nokia's denial of the claims.

🚨Cyberattack Alert ‼️ 🇫🇷France - Europe Qualité INC Ransom ransomware group claims to have breached Europe Qualité. Allegedly, 500 GB of data were exfiltrated. Samples have been provided.

🚨Cyberattack Alert ‼️ 🇺🇸USA - DZS Lynx ransomware group claims to have breached DZS, a provider of fiber access and optical telecommunications networking and cloud software technology Samples have been provided.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Winnebago Public Schools Interlock hacking group claims to have breached Winnebago Public Schools. Allegedly, 223 GB of data, including personal data of employees and students, as well as SQL databases, were exfiltrated. On October 21, Winnebago Public Schools announced that they had fallen victim to a cyberattack.

🚨Cyberattack Alert ‼️ 🇪🇸Spain - Universidad Católica de Valencia (UCV) INC Ransom ransomware group claims to have breached Universidad Católica de Valencia. The cybercriminal group is threatening to publish 1.5 TB of data stolen from UCV and has provided various samples.

🚨Cyberattacks 🚨 The ransomware group Helldown has resurfaced with a new onion address; 15 new victims listed on the data leak site. Here is the list in chronological order: 27.08 Klinik am Kurpark (DE) 22.09 Haus des Stiftens (DE) 22.09 Nightnurse Images (CH) 07.10 Fuelco US (US) 13.10 Gonzalez Castillo Moya (US) 14.10 General Dentistry for Children (US) 14.10 Knox Law Center (US) 14.10 American Ventures (US) 14.10 CSI Kitchen & Bath (US) 14.10 San Jacinto County (US) 15.10 Compass Funding Solutions (US) 26.10 La Clinique Du Coureur (FR) 26.10 Saint-Joseph-de-Tivoli High School (FR) 27.10 Qualiform (CZ) 31.10 S.M.A.R.T.S Engineering (DE) Note: Klinik am Kurpark in Reinhardshausen reported being severely affected by a cyberattack on the night of August 27, 2024, which matches the date indicated by Helldown. The date for Haus des Stiftens also appears to align, as a communication from September 21 reported a ransomware attack on the company’s systems.

🚨Cyberattack Update 🇲🇽Mexico - Aeroportuario del Centro Norte (OMA) Grupo Aeroportuario del Centro Norte (OMA) confirmed a ransomware attack on October 18, 2024, which encrypted some of its files and systems and led to the exfiltration of sensitive information. The compromised data reportedly includes information related to commercial clients, suppliers, and employees, which the attacker has allegedly disclosed. Despite the attack, OMA has not paid any ransom and reports no material impact on its operations, results, or financial standing, which it will continue to monitor. Disclosure: https://ir.oma.aero/wp-content/uploads/2024/11/OMA_Informa_Cyber_Seguimiento05nov24_v2.pdf

🚨Cyberattack 🚨 🇧🇷Brazil - Lojas Marisa Lojas Marisa, a Brazilian retail company, reported a ransomware cyberattack that temporarily disrupted parts of its systems. In response, the company implemented security protocols, including isolating and temporarily suspending some systems to protect information More details: https://br.investing.com/news/stock-market-news/lojas-marisa-sofre-ataque-cibernetico-e-avalia-extensao-do-incidente-1385581

🚨Cyberattack Alert ‼️ 🇺🇸USA - Alliance Technical Group Medusa hacking group claims to have breached Alliance Technical Group. Allegedly, 1.2 TB of data were exfiltrated. Ransom demand: $600,000. Ransom deadline: 18th Nov 24.

🚨Cyberattack 🚨 🇯🇵Japan - Tohoku Gakuin University (学校法人東北学院) On September 7, 2024, a ransomware attack on a work PC used by staff at Tohoku Gakuin University led to the unauthorized download of sensitive personal data, resulting in the exposure of 7,085 records. The compromised data includes information related to external companies, university students, and university staff. Specific information leaked includes names, phone numbers, email addresses, student grades, and employee IDs. The attack targeted a device accessible via external networks, where attackers stole user credentials to infiltrate the system. Source: https://www.tohoku-gakuin.ac.jp/info/top/241106-1.html

🚨Cyberattack 🚨 🇮🇹Italy - The blood donation scheduling system of Avis in San Francesco al Campo was disrupted by a cyberattack, compromising the data center (CED) infrastructure in Torino and rendering the AvisNet application inaccessible. This breach has left booking lists for the November 17 blood donation drive unusable, prompting Avis to urgently request donors to contact a dedicated number to confirm their appointments manually. Avis is actively working to restore its system in hopes of minimizing disruptions on November 17 More details: https://www.giornalelavoce.it/news/cronaca/549217/attacco-hacker-allavis-la-solidarieta-messa-in-ginocchio-ma-i-donatori-non-si-arrendono.html