Fidelity customers’ financial info feared stolen in suspected ransomware attack

source: the register.com (submitted by FAN, Steve Page)  |  image: pixabay.com

Criminals have probably stolen nearly 30,000 Fidelity Investments Life Insurance customers’ personal and financial information — including bank account and routing numbers, credit card numbers and security or access codes — after breaking into Infosys’ IT systems in the fall.

According to Fidelity, in documents filed with the Maine attorney general’s office, miscreants “likely acquired” information about 28,268 people’s life insurance policies after infiltrating Infosys.

“At this point, [Infosys] are unable to determine with certainty what personal information was accessed as a result of this incident,” the insurer noted in a letter [PDF] sent to customers. However, the US-headquartered firm says it “believes” the data included: names, Social Security numbers, states of residence, bank accounts and routing numbers, or credit/debit card numbers in combination with access code, password, and PIN for the account, and dates of birth.

In other words: Potentially everything needed to drain a ton of people’s bank accounts, pull off any number of identity theft-related scams — or at least go on a massive online shopping spree.

LockBit claimed to be behind the Infosys intrusion in November, shortly after the Indian tech services titan disclosed the “cybersecurity incident” affecting its US subsidiary, Infosys McCamish Systems aka IMS. It reported that the intrusion shuttered some of its applications and IT systems [PDF].

This was before law enforcement shut down at least some of LockBit’s infrastructure in December, although that’s never a guarantee that the gang will slink off into obscurity — as we’re already seen.

Russian Hackers Stole Microsoft Source Code—and the Attack Isn’t Over

source: wired.com  |  image: pexels.com

In January, Microsoft revealed that a notorious group of Russian state-sponsored hackers known as Nobelium infiltrated the email accounts of the company’s senior leadership team. Today, the company revealed that the attack is ongoing. In a blog post, the company explains that in recent weeks, it has seen evidence that hackers are leveraging information exfiltrated from its email systems to gain access to source code and other “internal systems.”

It is unclear exactly what internal systems were accessed by Nobelium, which Microsoft calls Midnight Blizzard, but according to the company, it is not over. The blog post states that the hackers are now using “secrets of different types” to breach further into its systems. “Some of these secrets were shared between customers and Microsoft in email, and as we discover them in our exfiltrated email, we have been and are reaching out to these customers to assist them in taking mitigating measures.”

Nobelium is responsible for the SolarWinds attack, a sophisticated 2020 supply-chain attack that impacted thousands of organizations that downloaded a compromised software update, and led to the compromise of around 100 organizations, including major US government agencies like the Departments of Homeland Security, Defense, Justice, and Treasury.

According to Microsoft, it has found no evidence that its customer-facing systems were breached.

The Hacking Threat Rises

source:  CNN.com  | image: pexels.com

At The New Yorker last month, Sam Knight detailed the devastating consequences of a ransomware attack on the British Library in London: “The outage became an incident. The National Cyber Security Centre, a branch of G.C.H.Q., the British equivalent of the National Security Agency, got involved. On November 20th, a hacking group called Rhysida—after a genus of centipedes—offered 490,191 files stolen from the British Library for sale on the dark Web. United States cybersecurity officials describe Rhysida as a ‘ransomware-as-a-service’ provider—a gun for hire—part of an increasingly professional array of cyber-extortion organizations.” Knight also noted the widely international array of apparent victims of this group: “Since Rhysida surfaced, in May, its victims have included the Chilean Army, a medical-research lab in Australia, and Prospect Medical Holdings, a health-care company with hospitals in Pennsylvania, Rhode Island, Connecticut, and California. There are reports that its code contains fragments of Russian, and it appears not to have struck inside Russia or its close allies.”
Continue reading “The Hacking Threat Rises” →