Ransomware attacks hit particularly hard in October, with at least one of the victims admitting to paying hackers the demanded sum to unlock their scrambled system. Big money may also be forthcoming from a class-action lawsuit filed against an online retailer for poor security practices. Finally, hackers hacked into a shop known for selling stolen credit card data. How’s that for irony? Cyber threats are typically not funny at all, which is why we publish our Month in Hacks to remind all to stay secure out there.
26M Stolen Credit Cards Rescued by Hack
Hackers found their way into BriansClub, a notorious underground store for purchasing stolen credit and debit card data. Hackers retrieved stolen data related to more than 26 million cards, data which had initially been snatched from online and physical retailers over a four-year period. The stolen data included nearly eight million records that had been added to the shop this year alone.
The number of stolen card records has been on the increase every year since 2015, the stolen data shows. BriansClub added 1.7 million card records for sale in 2015. The haul from January to August in 2019 was 7.6 million stolen card records.
Alabama Hospitals Pay Up in Ransomware Attack
A ransomware attack that hit Alabama’s DCH Health Systems on October 1 resulted in a payout from the hospitals, the AP reports. The three-hospital system had been compromised by hackers using a ransomware variant known as Ryuk, which locked all the files within the system.
Although the hospitals were able to continue caring for existing patients using paper files, new patients were diverted to other hospitals while the computer files remained locked. While a hospital spokesperson had been quoted in The Tuscaloosa News saying the hospitals paid the attackers for the key to unlock the files, the amount of the payout was not disclosed.
Payment Provider Billtrust Plagued by Ransomware
The B2B payment provider Billtrust is in the midst of recovering from a ransomware attack discovered on October 17. The cloud-based service allows customers to manage, pay and request invoices. The attack shut down several systems that became inaccessible to customers.
Along with restoring its system to proper working order, the company was also installing additional security measures. Billtrust did not say whether or not it paid the ransom that the hackers demanded. However, Billtrust did say it had cybersecurity insurance for such situations.
CafePress Facing Lawsuit Related to Data Breach
The online custom gift shop of CafePress is facing a class-action lawsuit related to a data breach that may have occurred as far back as February 2019. The shop notified customers of the breach on October 2, months after it is suspected of occurring. Some consumer sites had been warning customers of the breach in mid-July, but CafePress did not send official notification until months later.
Data stolen in the breach is thought to contain names, addresses, email addresses, phone numbers and passwords of 23 million customers. The lawsuit alleges CafePress failed to engage in best practices to alert customers of the breach. The shop has also been under fire for its poor cybersecurity software SHA-1, which the law firm said “has been useless in protecting data since about 2005.”
That’s it for October but we’ll back next month to tell you what went down in November. As a reminder, TeleSign can help protect both your platform and your users from these types of attacks. To learn more about how, contact your TeleSign sales professional today.