Hackmanac Cyber Alerts

🚨 #CyberAttack 🚨 🇮🇹 #Italy, Studio Notarile Bucci - Olmi Studio Notarile Bucci - Olmi has been listed as a victim by the Everest ransomware group. The hackers allegedly exfiltrated 400 GB of data. The sample provided includes filled-in forms and personal documents. #Ransomware

🚨 #CyberAttack 🚨 🇧🇷 #Brazil, CeoPag & CeoFood CeoPag & CeoFood have been listed as victims by the RansomHub ransomware group. The hackers allegedly exfiltrated 200 GB of data, including private documents, databases, webmails, and source code. This data contains private information from over 6,000 restaurants and more than 600,000 customers. Affiliated companies included in the leak: CeoPag, CeoFood, Ailine, EvoluxBank, OceanPay, VaePay, VibraPay, SilverPay, PulseBank, ExcellentPay, UaiPag, UsemobPay, CooperativaGontijo, BankPax, BancoG8, NovusPay, UsaPayBrasil, GP3Invest, JasperPay, AgenciaJS. Ransom deadline: 24th Jul 24. #Ransomware

🚨🚨New hacking group detected – Fog, 7 victims listed: 🇴🇲: German University of Technology in Oman - claimed on 17th July 🇺🇸: West Allis – West Milwaukee School District - claimed on 11th July 🇦🇺: DJG Projects - claimed on 7th July 🇺🇸: Alvin Independent School District - claimed on 4th July 🇳🇱: Verweij Electrical Engineering - claimed on 4th July 🇺🇸: Asbury Theological Seminary - claimed on 24th June 🇦🇺: Geelong Lutheran College - claimed on 19th June Fog is the second of the two new hacking groups discovered today. This group does not have an "About Us" section like the Mad Liberator group we previously mentioned, but from the type of victims listed, it is clear that their primary target, at least for now, has been the education sector. #Ransomware

🚨🚨New hacking group detected – Mad Liberator, 6 victims listed: 🇮🇹: Ministry of Culture - Fully leaked 🇪🇸: Vitaldent - Fully leaked 🇿🇼: ZB Financial Holdings - Deadline 23rd July 🇿🇦: South African Cities Network - Fully leaked 🇬🇧: Crosswear Trading - Fully leaked 🇪🇸: Montero & Segura Procuradores Asociados - Fully leaked Mad Liberator is one of the two new hacking groups discovered today. From the "About Us" section, it is clear that this is a classic ransomware group: "If you see files with random extensions, don't worry! They are not damaged. They have been encrypted using the AES/RSA algorithm and are safe. You may also see files like readme.txt or restore_files.txt appear on your drives." #Ransomware

🚨 #CyberAttack 🚨 🇺🇸 #USA, Lantronix Lantronix, a global provider of secure IoT and wireless connectivity data access and management solutions, has been listed as a victim by the Hunters International ransomware group. Allegedly, the attack led to the exfiltration of 587.6 GB of data (906,225 files), including: - Employee medical and background check records; - Penetration test report; - Encryption DLL practice; - Patent application; - Private accounting; - CFO data. #Ransomware #DataBreach https://x.com/H4ckManac/status/1813224802506739878

🚨 #CyberAttack 🚨 🇺🇸 #USA: Braum's Braum's, an American chain of ice cream parlor and fast food restaurants, has been listed as a victim by the Hunters International ransomware group. Allegedly, the attack led to the exfiltration of 1.5 TB of data, including: - Employees’ data (SSN, DOB, First Name, Middle Name, Last Name, Gender, True Date of Hire, Address, City, State, ZIP, Medical Tier), - Product formulas and recipes, - 2024 contracts and contractor insurance, - CEO’s personal and sensitive data, - QuickBooks data - Lawsuits #Ransomware #DataBreach https://x.com/H4ckManac/status/1813220618948501954

🚨🚨🚨 #CyberAttack 🚨🚨🚨 🇯🇵 #Japan: Hoya Corporation - Hackers Demanded $10,000,000 Hoya Corporation, one of the largest global manufacturers of optical products, has been listed as a victim by the Hunters International ransomware group. Allegedly, 2 TB (1,771,224 files) of data, including confidential data, R&D data, technical drawings, drivers' information database, personally identifiable information, HR database, senior manager data, clinical research and development data, and biometric data, was exfiltrated. -- The attack began in April: At the beginning of April, Hoya Corporation disclosed that a "system failure" caused servers at some of its production plants and business divisions to go offline due to a cyber attack. It was later confirmed that the attack was conducted by the Hunters International ransomware operation, which demanded a $10 million ransom for a file decryptor and not to release files stolen during the attack. #Ransomware #DataBreach https://x.com/H4ckManac/status/18132164

🟧 #HackTuesday 🟧 Hack Tuesday: Week 10 - 16 July 2024 ⚠️ 76 victims by 28 hacking groups ⚠️ The most active ransomware group this week is Hunters International with 8 claimed attacks. The most affected country is the United States, accounting for 50% of the victims, while the Professional, Scientific, and Technical sectors are the most affected, accounting for 22% of the claimed targets, followed by the Manufacturing sector with 20% and Healthcare with 11%. The average Cyber Risk Factor is 4.2. For a detailed look, visit our Hack Tuesday weekly report at: https://hackmanac.com/news/hack-tuesday-week-10-16-july-2024 #Ransomware #DataBreach #CyberAttack #HT https://x.com/H4ckManac/status/1813208493341417751

⚠️#DataLeak - Trello Trello: 15,111,945 User Records Leaked (Again) The same threat actor who on January 16th had put up for sale more than 15 million Trello user records, is now offering the data again and making it available for free. Compromised data: Email addresses, Names, Usernames #Trello https://x.com/H4ckManac/status/1813205750048497727

#CryptoTheft ⚠️Dough Finance Hack: $1.8 Million Stolen Dough Finance, a decentralized finance (DeFi) protocol, lost $1.8 million in digital assets due to a flash loan attack. The attack occurred on July 12 and was flagged by Web3 security firm Cyvers, which detected multiple suspicious transactions. The attacker exploited unvalidated call data within the "ConnectorDeleverageParaswap" contract, leading to the theft of 608 ETH. Read More: https://cointelegraph.com/news/dough-finance-loses-1-8m-flash-loan-attack #FlashLoan #ETH #Ethereum https://x.com/H4ckManac/status/1813179549758140435

🚨 #CyberAttack 🚨 🇺🇸 #USA: South Bay Regional Public Communications Authority South Bay Regional Public Communications Authority has been listed as a victim by the DragonForce ransomware group. Allegedly, 54.43 GB of data was exfiltrated. The ransom deadline is 28th July 2024. #Ransomware #DataBreach https://x.com/H4ckManac/status/1813122971847807326

🚨 #CyberAttack 🚨 🇬🇧 #UK: CDS, a Hewlett Packard Enterprise CDS, a Hewlett Packard Enterprise, has been listed as a victim by the BlackBasta ransomware group. Allegedly, 500 GB of data was exfiltrated, including company data, confidential data, human resources, hire data, personal employees' documents, clients' data, and project information. The ransom deadline is 23rd July 2024. #Ransomware #DataBreach https://x.com/H4ckManac/status/1813109989461889311

🚨 #CyberAttack 🚨 🇺🇸 #USA, Gramercy Surgery Center Gramercy Surgery Center has been listed as a victim by the Everest hacking group. The attackers allegedly exfiltrated 465 GB of data. The provided sample includes physicians' information and patients' data. #Ransomware #DataBreach https://x.com/H4ckManac/status/1813092814449783259

On June 28th, VIVA issued the following statement:

🚨 #CyberAttack 🚨 🇧🇴 #Bolivia: VIVA Bolivia VIVA Bolivia (Nuevatel PCS de Bolivia S.A) has been listed as a victim by the Dunghill ransomware group. The attackers allegedly exfiltrated 10 TB of data, including project files, personal identification information, confidential documents, databases, clients data, financial data, accounting, HR info, operations, corporate data, marketing, projects, development strategy, business agreements, and IT infrastructure. #Ransomware #DataBreach https://x.com/H4ckManac/status/1813085521993990163

🚨 #CyberAttack 🚨 🇧🇷 #Brazil: ValeCard ValeCard has been listed as a victim by the Medusa ransomware group: $500,000 demanded. The attackers allegedly exfiltrated 107.6 GB of data. The sample provided shows financial data, personal data, passports, minors' personal documents, certificates, confidential data, contact data (address, phone number, email, etc.), and other miscellaneous sensitive documents. Ransom deadline: July 24, 2024. #Ransomware https://x.com/H4ckManac/status/1813080914391388332

🚨🚨🚨 #CyberAttack 🚨🚨🚨 🇮🇱 #Israel: Sheba Medical Center Sheba Medical Center has been listed as a victim by the Handala hacking group. The attackers allegedly exfiltrated 5 TB of data, including medical and personal information of patients, cooperation agreements, staff lists, financial documents, administrative documents, and medical research documents. "We could have targeted all parts of this center and endangered the lives of thousands of people, but according to our discretion, we destroyed the heart department of this hospital and Innovalve Bio Medical Ltd just to warn! " the group writes. #DataBreach #Healthcare https://x.com/H4ckManac/status/1812866783046410691

🚨 #CyberAttack 🚨 🇩🇪 🇺🇸 - MS Ultrasonic Technology Group MS Ultrasonic Technology Group has been listed as a victim by the Hunters International ransomware group. The attackers allegedly exfiltrated 3.7 TB (2,426,871 files) of PII and the CEO’s data. Ransom deadline: 19th Jul 24. #Ransomware https://x.com/H4ckManac/status/1812860041340358669

🚨 #CyberAttack 🚨 🇺🇸 #USA: U.S. Dermatology Partners U.S. Dermatology Partners has been listed as a victim by the BlackBasta ransomware group. The attackers have not specified the exfiltrated data amount or type. This is the second time that U.S. Dermatology Partners has been added to the victim list of a cybercriminal group: on June 26th, the hacker group BianLian claimed to have exfiltrated 300 GB of personal data, accounting, budget, financial data, contract data and NDAs, and employees' profiles. #Ransomware https://x.com/H4ckManac/status/1812851066083446801

🚨 #CyberAttack 🚨 🇺🇸 #USA: ComNet Communications ComNet Communications has been listed as a victim by the Hunters International ransomware group. The hackers allegedly exfiltrated 1.6 TB (861,025 files) of data, including confidential data and technical designs, etc. Ransom deadline: 18th Jul 24. #Ransomware https://x.com/H4ckManac/status/1812846339178340723