The IT Nerd

Shell has confirmed in a very brief statement that hackers accessed the personal information of some employees as part of the global MOVEit Transfer tool vulnerability exploitation.  

The Clop ransomware group claims on its leak site that it published Shell’s data after the company refused to negotiate, but the links to the 23 archive files labeled ‘part1’ appear to be broken. Shell currently has 86,000 employees around the world, but they did not mention how many of those employees may have been affected or what data was be stolen. 

Shell was also targeted by the Cl0p group in 2020, through a zero-day exploit targeting an Accellion file transfer service. 

According to Brett Callow, threat analyst at Emsisoft, so far, the vulnerability in MOVEit has pwned this number of organizations: 

Carol Volk, EVP, BullWall had this to say:

   “According to Brett Callow, threat analyst at Emsisoft, so far, the vulnerability in MOVEit has Affected more than 17.5 million people’s PII. Much of this information will be used in attempts to access networks and some of those attempts will be successful. At this rate of exposure is almost impossible to fully protect networks from intrusion. Get your defenses up – get your backup and containment systems ready, they are definitely coming for the rest of us.”

Stephen Gates, Principal Security SME, Horizon3.ai followed up with this:

   “The MOVEit debacle, and associate breaches now impacting 17.5+ million people (and counting), will likely go down in history as proof that organizations must do a better job of immediately applying patches when they are available. When organizations wait to apply patches means the window of opportunity is wide open for attackers.

   “Although multiple patches have been available to address CVE-2023-36934, 36933, and 36932, the Clop ransomware group is still making claims that it has compromised data from many organizations. The conclusion one can draw from this is that many organizations have not applied the patches. So why is that probably the case?

1. Organizations may be delaying, seeing if there are any new vulnerabilities lying in wait.
2. They may be waiting for a final patch to avoid multiple patch cycles.
3. They may be waiting for an approved maintenance window to patch.
4. They do not believe they are exploitable or that the risk of exploitation is low.
5. They are completely unaware of the issue at hand.

   “Regardless of their reasoning, organizations are putting tens of millions of people at risk.”

I think it’s more than clear that the MOVEit vulnerability is a “today problem.” Organizations need to patch. And then if new patches come out, they need to patch some more. Alternately they can just dump MOVEit. Either way, sitting on the sidelines is not an option.

The Russian gang ALPHV claimed on its website last week that it had obtained seven terabytes of internal documents from the Barts Health NHS Trust, a network of five hospitals in London that care for about 2.5 million people, and threatened to post them online unless a ransom is paid.

 A spokesperson for the UK’s National Cybersecurity Centre said in a statement on Wednesday that it was “working with Barts Health NHS Trust and partners to fully understand the impact of an incident,” and a spokesperson for Barts said that it was “urgently investigating” the hacking gang’s claims.
 
The extent of the damage caused by this incident isn’t clear yet, but the gang published a selection of files it said it stole, including copies of employees’ driving licenses and passports, internal emails and correspondence marked confidential. In broken English, the hackers claimed that the haul of data amounted to the “most bigger leak from health care system in UK.”
 
The breach marks the third major cyberattack that Barts has faced in the last six years.

Roy Akerman, Co-Founder & CEO, Rezonate had this to say:

 “Healthcare providers continue to be a target for malicious adversary and in particular Ransomware groups. The PII reported stolen is valuable intelligence attackers are constantly trying to obtain to be used as follow up attacks and sell them to the highest bidder. As such, healthcare providers must validate their security and assure readiness at all times, across every initial attack technique as well as the detection and prevention once the attacker tries to expand across the network.”

Carol Volk, EVP, BullWall follows up with this:

   “This new cyberattack on the Barts Health NHS Trust highlights the persistent and growing dangers of ransomware in the health sector. This incident serves as a stark reminder of the urgent need for robust cybersecurity measures, including ransomware containment, to be made mandatory for organizations in the healthcare industry. This breach not only poses a significant risk to the affected individuals but again raises broader concerns regarding patient privacy and the security of healthcare systems as a whole.

   “What makes this incident particularly alarming is that it is the third major cyberattack that Barts Health NHS Trust has faced in the past six years. This pattern of repeated attacks underscores the vulnerability of the healthcare sector to cyber threats. It is imperative that healthcare organizations prioritize cybersecurity investments and adopt proactive measures to safeguard patient data and critical infrastructure.”

 Roy Akerman, Co-Founder & CEO, Rezonate concludes with this:

 “Healthcare providers continue to be a target for malicious adversary and in particular Ransomware groups. The PII reported stolen is valuable intelligence attackers are constantly trying to obtain to be used as follow up attacks and sell them to the highest bidder. As such, healthcare providers must validate their security and assure readiness at all times, across every initial attack technique as well as the detection and prevention once the attacker tries to expand across the network.”

We’ll find out the full scale of this breach soon enough, assuming that this breach actually happened. Consider this one of those stories to stay tuned to.