That cybercriminals exfiltrate data from companies is currently an everyday phenomenon. The criminal online gang The Gentlemen now shows entries for Confluent, Deloitte, KFC, and MoneyGram on its darknet leak site. The perpetrators do not provide information on the type and scope of the data.
The countdown for the Deloitte entry has already counted down 40 hours longer than for the other entries. The entry from the cyberattack on FTAPI, which became known at the end of September, looked similar. Meanwhile, the countdown has given way to a button that displays the data.
At first glance, the dataset contains advertising and marketing material in particular, but there also appears to be a customer list (existing customers) among it. FTAPI had already admitted a breach into a single local server and subsequently informed affected customers and partners. The FTAPI platform and customer systems were not impacted. There are also no indications of this in the dataset now published on the darknet.
According to their statements, the perpetrators were also able to penetrate the airline Air Canada and steal data; Air Canada has not yet confirmed this. The group has now also published this data on the darknet. It appears to be OneDrive dumps. The individual folders seem to contain blog posts and IIS-ASPX pages, but also various tables and apparently recordings of teleconferences, for example on secure programming. Further directories point to training information on various aircraft types or on handling drones. Other directories and files are more likely to indicate personal mailboxes and data of individual employees.
It remains unclear what data the criminal online group was able to obtain unauthorized from Confluent, Deloitte, KFC, and MoneyGram. So far, the impression is that it is not particularly valuable or critical data, but often marketing materials and data of individual employees – in other cases, however, it can look completely different. The companies now allegedly affected have not yet reacted to the extortionists’ claims with published statements.
Don’t miss any news – follow us on
Facebook,
LinkedIn or
Mastodon.
This article was originally published in
German.
It was translated with technical assistance and editorially reviewed before publication.
