The Week in Breach News: 04/24/24 – 04/30/24

Risk to Business: 1.741 = Extreme

A Russia-linked threat actor has claimed it’s behind a cyberattack on an Indiana wastewater treatment plant. The Cyber Army of Russia posted video on its Telegram channel supporting their claim. Officials at the plant confirmed the attack, saying that although the hackers were successful, the plant’s IT infrastructure took minimal damage in the incident. The group is suspected of being behind other water and wastewater facilities including a recent hack in Texas in January.

Risk to Business: 1.856 = Extreme

The LockBit cybercrime group says that it gained access to the network of the District of Columbia Department of Insurance, Securities and Banking (DISB) and snatched sensitive data. The gang claims to have stolen 800 GB of sensitive financial data including files pertaining to the U.S. Securities and Exchange Commission (SEC), Delaware banking institutions and other financial entities as well as DISB operations. The data was likely obtained from DISB’s STAR system client in late March 2024 which was maintained by Tyler Technologies. The incident is under investigation.

Risk to Business: 1.721 = Severe

The Coast Guard Reserve has alerted thousands of personnel that their personal data may have been exposed in a cyberattack. Officials said that on January 24, 2024, a person sent a tranche of Coast Guard members’ personal data to people who were not authorized to view it. 10,700 Coast Guard Reserve members were impacted. 7,554 individuals had their home addresses exposed. The names and employee identification numbers of another 3,146 personnel were also included.

Risk to Business: 1.803 = Severe

A ransomware attack has resulted in the government of Coffee County, Georgia, temporarily severing its connection to the state’s voter registration system. This is a particularly concerning development as the U.S. presidential election grows closer. The early April attack left some county workers using cellular networks for internet access. County officials said they saw no evidence of exfiltration of data/files. The incident is still under investigation.   

Risk to Business: 1.712 = Severe

British Columbia-based London Drugs disclosed that it has experienced a cybersecurity incident that resulted in the temporary closure of all 79 of its retail stores across Canada. The company has not released a timeline for the reopening of those stores. London Drugs was quick to assure customers that at this time does not believe any consumer or employee data was stolen. The incident remains under investigation.  

Risk to Business: 2.376 = Severe

UK carpet retailer Carpetright fell victim to a cyberattack last week that disrupted operations including customer order processing. Carpetright said that its network was taken offline fast to ensure that the malware was isolated before the bad actors were able to access or steal any data. Employees were left unable to access their payroll information, customer service phone lines were knocked out and customers experienced order fulfillment delays.

Risk to Business: 1.866 = Moderate

A March 7, 2024, cyberattack on the city of Leicester has left the city’s streetlights on 24/7. In the wake of the attack, many city offices were left without phone and computer systems. Those systems have since been restored, but the issue of the perpetually on streetlights has not yet been solved. City officials said that the problem was caused by the shutdown of IT systems in the wake of the cyberattack. That shutdown left city workers unable to access the inner workings of the city’s lighting system, which is set to keep the lights on all the time in default mode. Bad actors were also able to snatch an indeterminate amount of data. The INC ransomware group has claimed responsibility for the attack.  

Risk to Business: 2.602 = Moderate

Happy Hour is over in Sweden as liquor store shelves empty in the wake of a cyberattack that crippled logistics company Skanlog. The company is a key distributor for Systembolaget, Sweden’s government-owned chain of retail shops for beverages stronger than 3.5% alcohol by volume. A Skanlog executive said that North Korean hackers are behind the attack. Officials warned that certain beers, wines and spirits could be sold out within a few days with no clear timeline for when the supply will begin flowing again.