Hackmanac Cyber Alerts

You can find more details in Troy Hunt's article: https://www.troyhunt.com/inside-the-demandscience-by-pure-incubation-data-breach/

🚨Data Leak Update 🚨 DemandScience by Pure Incubation: 122M Unique Corporate Email Addresses Affected As reported today by Have I Been Pwned, data from DemandScience (Pure Incubation) appeared for sale on a hacking forum in early 2024. The leak, attributed to a decommissioned legacy system, exposed 122 million unique corporate email addresses, physical addresses, phone numbers, employers, job titles, names, and LinkedIn profile links for numerous individuals. HIBP permalink: https://haveibeenpwned.com/PwnedWebsites#DemandScience

🚨Data Leak Update 🚨 DemandScience by Pure Incubation: 122M Unique Corporate Email Addresses Affected As reported today by Have I Been Pwned, data from DemandScience (Pure Incubation) appeared for sale on a hacking forum in early 2024. The leak, attributed to a decommissioned legacy system, exposed 122 million unique corporate email addresses, physical addresses, phone numbers, employers, job titles, names, and LinkedIn profile links for numerous individuals. HIBP permalink: https://haveibeenpwned.com/PwnedWebsites#DemandScience

🚨Cyberattack Alert ‼️ 🇯🇵🇪🇸 - J.S.T. The Black Suit hacking group claims to have breached the Spanish branch of J.S.T. J.S.T. España, S.A. is part of the Japanese multinational based in Osaka, J.S.T. MFG CO., LTD. (日本圧着端子製造), one of the world’s leading manufacturers of connectors and terminals for the electrical and electronics industry.

🎬 Our First Video is Here! 🎬 Ever wonder what it’s like to chase down a crypto thief and recover millions? In our debut video, we’re pulling back the curtain on a $68 million recovery operation that sent shockwaves through the crypto underworld This is more than just a story—it’s a look at how we took on the hackers, played on our terms, and got every dollar back. Curious? Dive into the action and see how we get the job done. Watch now!

🚨New Hacking Group Detected: Kairos The group has a typical onion blog where it publishes its victims, currently totaling six. They appear to have a preference for targeting the healthcare and accounting sectors. Here is the list: 🇹🇼Taiwan - Formosa Certified Public Accountant 🇺🇸USA - PMR Centre 🇺🇸USA - Accounting & Advisory Services 🇺🇸USA - Clay Platte Family Medicine Clinic 🇺🇸USA - Kansas Regenerative Medicine 🇺🇸USA - Sunny Days Sunshine Center For all targets, samples are provided, generally showing PII, medical data, employee data, and other sensitive documents. Additionally, PMR Centre was previously listed by the cybercriminal group MEOW on July 8, while our database shows that the protected health information of patients from Clay Platte Family Medicine was compromised in a data breach in June 2024. Overall, the site bears many similarities to the template used by the Cactus ransomware group.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Giggle Finance Kill Security hacking group claims to have breached Giggle Finance. Allegedly, exfiltrated data includes detailed financing application records containing personal information (name, email, phone, SSN, DOB, address), employment and income details, financial information (bank info, amount), verification data, eligibility and history records, session timestamps, user and system IDs, and application management statuses. Ransom deadline: 21st Nov 24.

🚨Cyberattack Alert ‼️ 🇨🇦Canada - Medigroup Health Services The RansomHub ransomware group claims to have breached Medigroup Health Services. The group states that they hacked Medigroup using simple passwords on their network and managed to exfiltrate 500 GB of data, including personal data, insurance information, medical test results, contact information, and prescriptions of all clients. Ransom deadline: November 17, 2024.

🚨Cyberattack Alert ‼️ 🇰🇷South Korea - SK Gas Ra World ransomware group claims to have breached SK Gas. Allegedly, 700 GB of data, including business contracts, department data, and other files, were exfiltrated.

🚨Cyberattack Alert ‼️ 🇧🇷Brazil - Axpr Valve Science Kill Security hacking group claims to have breached Axpr Valve Science. Allegedly, exfiltrated data include employee names, contact details, equipment details, financial invoices, tax IDs, inventory descriptions, PII, financial data, and private business information. Ransom deadline: 21st Nov 24.

🚨🚨🚨Cyberattack Alert ‼️ 🇺🇸USA - American Associated Pharmacies (AAP) Embargo ransomware group claims to have breached American Associated Pharmacies (AAP), a nationwide Member-owned cooperative comprised of more than 2,000 independent pharmacies. According to the post, the cybercriminal group managed to exfiltrate and encrypt 1.469 TB of data and set the ransom deadline for the 20th of Nov 24. Additionally, Embargo reveals their full greed and states that AAP has already paid 1.3 million for decryption and owes the group another 1.3 million for the 1.469 TB of their data.

🟧 #HackTuesday 🟧 Hack Tuesday: Week 06 - 12 November 2024 ⚠️196 cyberattacks across 37 countries ⚠️ ➡️The most active threat actor this week is Nam3L3ss, claiming to have leaked data from 25 companies. ➡️The USA is the most affected country, accounting for 55% of the victims, with 107 cyberattacks. ➡️The Professional / Scientific / Technical sectors are the most impacted, representing 14% of the claimed targets, followed by the Manufacturing with 11%. ➡️Overall, the claimed compromised data amounts to approximately 43 TB. ☣️The average ESIX® (Estimated Severity Index) is 4.6. Follow the link for list of referred victims: https://hackmanac.com/news/hack-tuesday-week-06-12-november-2024 #Hackmanac #HT #Cybersecurity

Very brief summary: Amazon confirmed a data breach involving employee information after the threat actor Nam3L3ss leaked data from the May 2023 MOVEit attacks on a hacking forum. The threat actor claims to have obtained additional data from exposed web sources, including databases and backups, totaling over 250TB from companies such as Lenovo, HP, TIAA, HSBC, and Delta. Nam3L3ss said: “1,000 releases coming, never seen before” Here is the full list with the claimed leaks posted on a hacking forum:

🚨Cyberattack Alert ‼️ 🇨🇻Cabo Verde - Banco de Fomento Internacional Lynx ransomware group claims to have breached Banco de Fomento Internacional. Allegedly, 220 GB of data were exfiltrated.

🚨Cyberattack Alert ‼️ 🇷🇴Romania - National Institute of Administration Kill Security hacking group claims to have breached the National Institute of Administration. Allegedly, exfiltrated data include PII such as names, CNPs, emails, and phone numbers, along with financial details on payments and tariffs, confidential business information on programs and training, and user accounts linked to personal and institutional emails. Ransom deadline: 20th Nov 24.

🚨Amazon Confirms Breach of Employee Data The post says the source of the data was #MOVEit, which is suite of cloud data management tools. #Cl0p https://www.404media.co/amazon-confirms-breach-of-employee-data/

🚨Cyberattack Update 🇯🇵Japan - Ishimitsu Shoji Co., Ltd. (石光商事株式会社) On November 1, 2024, Ishimitsu Shoji, a Japanese food trading company, provided an update on the ransomware attack initially disclosed on September 20, 2024. The attack infiltrated the company’s systems through remote desktop access on a SIM-enabled laptop, leading to unauthorized access to multiple servers and encryption of various files. However, the attack encrypted specific personal data without backups, leading to irreversible data loss. The compromised data includes 21 internal personal records of employees and dependents and external information such as 28 resumes submitted for job applications. Additionally, a subsidiary, US Foods, reported compromised information, including 13 internal records and up to 100 bank account details for refunds and 11 resumes. Source: https://contents.xj-storage.jp/xcontents/AS90749/c1283b79/e663/48c3/9970/671ac391c2bc/140120241031508178.pdf

🚨Crypto Theft 🚨 Delta Prime suffers a $4.8M exploit due to vulnerabilities in its protocol, marking its second significant security breach this year alone. https://cryptonews.com/news/delta-prime-defi-protocol-falls-victim-to-4-8m-exploit-peckshield/

🚨Cyberattack Alert ‼️ 🇦🇺Australia - Followmont Transport Pty Akira ransomware group claims to have breached Followmont Transport Pty. Allegedly, 230 GB of data were exfiltrated, including NDAs, passports, driver licenses, medical documents, and detailed financial information.

🚨Data Breach Alert 🚨 🇵🇪Peru - BBVA Bank of Peru A threat actor known as "Gatito_FBI_NZ" has claimed to have exploited a vulnerability in BBVA Bank of Peru, resulting in the exposure of sensitive customer transaction data. The compromised information reportedly includes: - DNI (National Identification Number) - Full Names - Benefits - Customer Segment - Merchant Name - Location - Geographical Code (Ubigeo) - Transaction Amount - Total Discount - Program Discount - Merchant Discount - Transaction Status - Transaction Date Various samples were provided, including login credentials. The confirmation or denial of these claims has yet to be verified