Hackmanac Cyber Alerts

🚨Cyberattack Alert ‼️ 🇮🇱Israel - Payxpress RansomHub hacking group claims to have breached Payxpress. Allegedly, exfiltrated data include miscellaneous documents containing personally identifiable information (PII). Ransom deadline: 02nd Nov 24.

🚨Cyberattack Alert ‼️ 🇦🇪UAE - Mixfame Kill Security hacking group claims to have breached Mixfame, a online casting platform. Allegedly, exfiltrated data includes personally identifiable information (PII) such as passport details (full names, nationality, date of birth, passport number, expiration date, and issuing authority) and modeling portfolios. Ransom deadline: 04th Nov 24.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Mastery Schools The DragonForce hacking group claims to have breached Mastery Schools, allegedly exfiltrating 171.19 GB of data. The chat provided by DragonForce indicates that the attack likely occurred around September 17. According to our database, Mastery Schools experienced a significant IT disruption on September 17 due to "suspicious activity" from an unauthorized external source, leading to a system-wide shutdown. The incident took phones offline, restricted email access, and forced teachers to operate without Internet, disrupting lessons reliant on Chromebooks.

🚨Cyberattack Alert ‼️ 🇬🇧UK - Accuracy International Ltd DragonForce hacking group claims to have breached Accuracy International, a British firearms manufacturer. Allegedly, 223.27 GB of data were exfiltrated. Ransom deadline: 29th Oct 24.

🚨The hacker returned $19.2 million to U.S. government wallets, including 13.19 million USDC and 2,408 Ethereum. This came after a suspicious transfer from a previously dormant, government-controlled crypto wallet containing over $20 million seized in the 2016 Bitfinex hack.

🚨Cyberattack ‼️ 🇮🇹Italy - ISA S.p.A. On October 22, 2024, ISA S.p.A., based in Bastia Umbra, Italy, experienced a cyberattack that resulted in the exfiltration of certain corporate data. The company confirmed the intrusion, which led to data theft, and has since reported the incident to law enforcement. More details: https://tuttoggi.info/attacco-informatico-ad-azienda-umbra-rubati-dati-si-indaga/865433/

🚨Cyberattack Alert ‼️ 🇫🇷France - Libération The French newspaper Libération fell victim to a ransomware attack on October 25, impacting the software used to layout its print edition https://www.lemonde.fr/pixels/article/2024/10/25/le-journal-liberation-victime-d-une-attaque-de-type-rancongiciel63595554408996.html

🚨Cyberattack ‼️ 🇨🇭Switzerland - OneLog A cyberattack has disrupted the Swiss login platform OneLog, preventing users from accessing multiple Swiss media sites since October 24, 2024. OneLog, used by over 40 media portals, including major outlets like Tamedia, Ringier, and SSR, has been down, leading these platforms to temporarily grant free access to their content. Certain functionalities, such as commenting on articles, are also disabled. According to Tamedia, only login data is managed by OneLog, and no additional user data is reported as compromised. However, the nature of the cyberattack remains unclear, with speculation suggesting possible data encryption or deletion in an extortion attempt More details: https://www.lfm.ch/actualite/suisse/piratage-informatique-problemes-de-connexion-aux-medias-suisses/

🚨Cyberattack Alert ‼️ 🇺🇸USA - Evergreen Local School District Fog hacking group claims to have breached Evergreen Local School District. Allegedly, 5.1 GB of data were exfiltrated, including commercial information, personal employee data, information about students' relatives, driver licenses, insurance documents, and health records.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Healthcare Services Group Underground Team hacking group claims to have breached Healthcare Services Group. Allegedly, 1.1 TB of data were exfiltrated, including confidential documents, agreements, contracts, financial and legal documents, vendor and supplier information, stockholder documentation, tax and recruitment documents, service proposals, invoices, and extensive employee information (including passports, IDs, SSNs, and various tax and payroll forms).

Hacking group or...❓ The hacking group APT73, first seen in March 2024, has rebranded under the name BASHE and listed 16 new victims on their data leak site. However, there's something "odd": Of the 16 victims published, the data of 6 appear to be a copy-paste of cyber attacks claimed by the ransomware group BlackBasta between June and July of this year. Additionally, 4 other leaks listed by BASHE are already present in HIBP for prior data breaches between January 2020 and November 2021. The number of exfiltrated records aligns almost perfectly, except for Robinhood, where there's a discrepancy of around 2 million records, likely due to Troy Hunt analysis, which probably excluded duplicates. Further analyses will be conducted on the remaining 6 names. However, following the modus operandi of the former hacking group APT73, these are probably not ransomware attacks, and perhaps these breaches aren’t even their work (unless there’s a remote chance they are the data brokers operating since 2020.)

🚨Cyberattack Alert ‼️ 🇮🇹Italy - Sfera Ufficio, Sample Shows Plain Text Passwords AlphaTeam hacking group claims to have breached Sfera Ufficio. Allegedly, they exfiltrated the full database and server files, including 177,317 entries of user data such as emails, plain text passwords, full names, physical addresses, phone numbers, codice fiscale, partita IVA, and IP addresses.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Cucamonga Valley Water District Fog hacking group claims to have breached Cucamonga Valley Water District. Allegedly, 41 GB of data, including human resources records, personal contacts, login credentials, and financial documents, were exfiltrated. According to our database, on August 15, the Cucamonga Valley Water District (CVWD) experienced a ransomware attack that disrupted certain systems, including phone lines and payment processing.

🚨Cyberattack Alert ‼️ 🇮🇱Israel - The Knesset Hellcat hacking group claims to have breached The Knesset, the unicameral legislature of Israel. Allegedly, 45 GB of data, including confidential documents, internal communications, and various classified information, were exfiltrated. Ransom demand: $200,000.

🚨Data Breach Alert ‼️ 🇪🇬Egypt - Egypt Post A potential data breach at Egypt Post has been detected on a hacking forum, reportedly affecting 150,000 users. According to the post, the data includes phone numbers, email addresses, full names, real customer addresses, full shipment details, and shipment timelines. The claims have yet to be confirmed or denied.

🚨Cyberattack Alert ‼️ 🇮🇳India - NoBroker Kill Security hacking group claims to have breached NoBroker, a Bangalore-based brokerage-free proptech company. Allegedly, exfiltrated data includes personally identifiable information (PII) such as names, addresses, PAN numbers, financial data on transaction amounts for stamp duty and registration fees, legal agreements for non-residential property usage, and consent for Aadhaar-based verification, including biometric data. Ransom demand: $50,000.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Aspen Healthcare Services Everest hacking group claims to have breached Aspen Healthcare Services. Allegedly, more than 1,500 medical records and personal information were exfiltrated. Ransom deadline: 09th Nov 24.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Spine by Villamil MD Everest hacking group claims to have breached Spine by Villamil MD. Allegedly, over 1,000 patient medical records were exfiltrated. Ransom deadline: 09th Nov 24.

🚨Cyberattack Alert ‼️ 🇺🇸USA - Pacific Pulmonary Medical Group Everest hacking group claims to have breached Pacific Pulmonary Medical Group. Allegedly, exfiltrated data include medical records and personal data of all patients from 2021. Ransom deadline: 08th Nov 24.

🚨Cyberattack Alert ‼️ 🇭🇰Hong Kong - Getz Bros. & Co. (HK) Fog hacking group claims to have breached Getz Bros. & Co. (HK). Allegedly, 45 GB of data, including human resources records, client contact data, internal financial documentation, trading agreements, and login credentials, were exfiltrated.