Ride the Lightning

Ransomware Gangs Outing Victims – and That Makes It a Data Breach

December 18, 2019

For a long time, it was safe to say that ransomware attacks were only rarely data breaches – mostly they were cyber incidents. That generally meant that you didn't need to report them under state data breach laws or in many other places. Your data was encrypted by the ransomware but it was not exfiltrated or compromised.

But now, KrebsonSecurity has reported that several prominent purveyors of ransomware have indicated they plan to start publishing data stolen from victims who refuse to pay up. To make matters worse, one ransomware gang has now created a public Web site identifying recent victim companies that have chosen to rebuild their operations instead of quietly acquiescing to their tormentors.

The cybercriminals behind the Maze Ransomware strain erected a website on the Internet, and it currently lists the company names and corresponding websites for eight victims of their malware that have declined to pay a ransom demand.

"Represented here companies dont wish to cooperate with us, and trying to hide our successful attack on their resources," the site explains in broken English. "Wait for their databases and private papers here. Follow the news!"

The information disclosed for each Maze victim includes the initial date of infection, several stolen Microsoft Office, text and PDF files, the total volume of files allegedly exfiltrated from victims (measured in Gigabytes), as well as the IP addresses and machine names of the servers infected by Maze.

The bad guys have in fact warned us about this. "For years, ransomware developers and affiliates have been telling victims that they must pay the ransom or stolen data would be publicly released," said Lawrence Abrams, founder of the computer security blog and victim assistance site BleepingComputer.com. "While it has been a well-known secret that ransomware actors snoop through victim's data, and in many cases steal it before the data is encrypted, they never actually carried out their threats of releasing it."

Abrams said that changed at the end of last month, when the crooks behind Maze Ransomware threatened Allied Universal that if they did not pay the ransom, they would release their files. When they did not receive a payment, they released 700MB worth of data on a hacking forum.

"Ransomware attacks are now data breaches," Abrams said. "During ransomware attacks, some threat actors have told companies that they are familiar with internal company secrets after reading the company's files. Even though this should be considered a data breach, many ransomware victims simply swept it under the rug in the hopes that nobody would ever find out. Now that ransomware operators are releasing victim's data, this will need to change and companies will have to treat these attacks like data breaches."

The move by Maze Ransomware comes just days after the cybercriminals responsible for managing the "Sodinokibi/rEvil" ransomware empire posted on a popular dark Web forum that they also plan to start using stolen files and data as public leverage to get victims to pay ransoms.

This is especially dreadful news for companies that may already face steep fines and other penalties for failing to report breaches and safeguard their customers' data. For example, healthcare providers are required to report ransomware incidents to the U.S. Department of Health and Human Services, which often documents breaches involving lost or stolen healthcare data on its own site.

To be candid, the ransomware incidents we've seen thus gave no indication that data had been taken before it was encrypted. It is impossible to know how often this was done in the past. But if this becomes the norm, then ransomware attacks may need to be treated as data breaches – or digital forensics teams may have to be brought in to determine if data was exfiltrated before it was encrypted.

This is a serious game-changer.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.
3975 University Drive, Suite 225|Fairfax, VA 22030
Email: Phone: 703-359-0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson