The IT Nerd

Japanese publishing giant Nikkei said that its Slack messaging platform had been compromised via an unauthorized external login which exposed the names, email addresses and chat histories of 17,368 individuals registered on Slack. An employee’s personal computer was infected with a virus, leading to the leakage of Slack authentication credentials which hackers used to gain unauthorized access to employee accounts.

Nikkei put out a statement on this here: https://www.nikkei.co.jp/nikkeiinfo/en/news/announcements/1394.html

Rainier Gracial, Senior Security Engineer at cybersecurity company Spin.AI, provided the following comments:

“Nikkei is a prime example of why protecting data within core SaaS applications like Slack is absolutely critical. People assume Slack is secure because it is private to their business employees, but that does not mean unauthorized access won’t happen. Organizations should always assume they will be breached at some point and leverage strong data leak prevention controls in addition to strict access controls.”

Paul Bischoff, Consumer Privacy Advocate at Comparitech adds this: 

“This breach demonstrates how organizations are only as secure as their weakest link. In a remote work environment, IT security teams struggle to secure devices used by non-IT personnel on the public internet. The risk is doubled if the devices are also for personal use. Hackers only need to compromise one person’s device to compromise the whole organization. In this case, the hacker used malware to steal one employee’s login credentials for Slack.”

Chris Hauk, Consumer Privacy Champion at Pixel Privacy offered this comment:

“Incidents like this one emphasize how important it is for organizations to regularly monitor their employees’ computers and other internet-capable devices to ensure that malware has not infected the devices. This is particularly important when companies allow employees to use their own computers and devices for work-related tasks. Organizations with such BYOD policies should require employees to have efficient virus and malware protection installed on their personal devices, preferably installed by the organization.”

This illustrates why a holistic approach to security is required in this day and age. From training to physical and software security measures, it all adds up to you not being the next organization that gets pwned.

The Swedish Authority for Privacy Protection (IMY) is investigating a cyberattack on IT systems supplier Miljödata that exposed data belonging to 1.5 million people. The ransomware gang, Datacarry, has claimed this attack. Here are details:

Sweden is investigating one of the largest data breaches in its history: an attack on IT systems provider Miljödata compromised the data of around 1.5 million citizens. Cybercriminals stole the information and published it on the darknet, and the regulator IMY has already started a GDPR compliance check. The Swedish Privacy Authority (IMY) announced the launch of an investigation after cybercriminals hacked the systems of Miljödata, a provider of IT solutions for 80% of the country’s municipalities.

The attack caused disruptions to government services in the regions of: Halland, Gotland, Skellefteå, Kalmar, Karlstad, Mönsterås. Later, the hacker group Datacarry published the stolen 224 MB archive on its darknet portal. The service Have I Been Pwned confirmed the appearance of the data and added it to its database.

Lidia Lopez, Senior Threat Intelligence Analyst at Outpost24, commented: 

“‘Datacarry’ is a financially-motivated ransomware group active since at least June 2024, the date when they claim to have targeted their first victim. They maintain a Data Leak Site (DLS) where they publish data from victim companies that didn’t pay the ransom amount requested to recover encrypted files. Datacarry ransomware attacks are presumably opportunistic, but most victims reported so far are medium-size businesses located in European countries. 

It is believed that Datacarry does not own a custom encryption tool, but like many other double extortion ransomware groups, they rely on the leaked Conti ransomware builder to encrypt victim files. For initial access, they have been observed targeting the vulnerable Fortinet EMS servers affected by CVE-2023-48788 vulnerability.”

These attacks keep getting worse and worse. And what’s really bad is the group behind this is effectively using “off the shelf tools” to pull this off. That shows that ransomware is getting to the point where it is close to being completely out of control. Which in terms means that the time for action to reverse this is now.