Ransomware attacks have now become data breeches: the criminals are now posting stolen information

[thewayne]

Early ransomware attacks were simple extortion. You open an infected email attachment, and it either contained the malware or downloaded the malware and it exploited your network and encrypted the network and demanded a ransom to get your data back.

Then the attackers got more sophisticated and hands-on involved.

The malware loaded a bunch of zero-day exploits, that is, attacks that were unknown or unpatched by operating system vendors, and thus undefended. This allowed the attackers full access to networks for an extended period of time. So they found valuable data, exfiltrated it to their GQ, THEN encrypted the servers that they had control over and demanded a ransom.

And part of the ransom demand was that you pay us to get your data back or you might not only face loss of your information, but you might also face us posting your data online or selling it to competitors.

The normal defense against ransomware has been good procedures for backups and recovery, and we used to think that was good enough. We could get our systems back: reformat, install a new copy of the operating system, patch, reload the data. Time consuming, but it's actually faster than unencrypting files because encryption/decryption is a very time-consuming process.

But the criminals are now posting internal corporate documents on public web servers, saying Company X didn't pay, they rebuilt their infrastructure without giving us a dime so here's their information.

This is obviously going to have potentially serious GDPR consequences in Europe, we'll see how it plays out over here, especially if no customer notification took place and if credit card information was involved.

https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/

Comments

[dewline]

And what happens when a patient who went to LifeLabs dies of what someone else does with criminally uploaded data? With or without malice?

[silveradept]

I'm waiting for the time where someone gets hit by ransomware, the data gets posted, and it turns out to have been something of great public interest that should have been disclosed and hasn't been, for nefarious reasons.

[thewayne]

Interesting thought, a not uncommon RPG plot where average adventurers steal docs for ‘their employer’ and find something with far-reaching consequences, casting doubt on for whom they are working.