The IT Nerd

From the “I can’t believe the scale of this” department, comes this story where Greece’s Land Registry has been hit by 400 cyberattacks that have resulted in what they call a “limited scale” data breach.

Mind. Blown.

I’m going to come back as to why my mind is blown. But first, here’s the relevant details:

The Land Registry agency in Greece has announced that it suffered a limited-scope data breach following a wave of 400 cyberattacks targeting its IT infrastructure over the last week.

The agency said hackers managed to compromise employee terminals and steal 1.2 GB of data, corresponding to roughly 0.0006% of the total data held by the government organization.

The stolen data reportedly does not contain any citizens’ personal information but primarily consists of typical administrative documents, the exposure of which is not expected to impact the registry’s operations.

The announcement also mentions that the hackers attempted to create a malicious user to infiltrate the agency’s central database, but they failed.

One of the database’s backups, which are updated daily, was accessed by the unauthorized actors. However, the subsequent attempt to exfiltrate the data to an external server was blocked.

The Land Registry’s internal investigation, aided by the Cybersecurity Directorate of the General Staff of National Defense, has not found any evidence of ransomware having been deployed on the breached systems.

Emergency actions to reduce the risk of ransomware have been taken, like terminating all VPN access to block malicious users.

Rogier Fischer, CEO, Hadrian had this comment:

“Based on the information provided, the data breach at the Land Registry agency in Greece doesn’t seem to fall under the GDPR’s mandatory disclosure bracket. The stolen data amounted to 1.2 GB or 0.0006% of the agency’s total data, and it primarily consisted of administrative documents without any citizens’ personal information,”

“Since the breach did not affect personal data or disrupt the agency’s operations, it likely doesn’t pose a significant risk to individuals’ rights and freedoms.”

“Despite the large number of cyberattacks, the agency successfully blocked attempts to exfiltrate data and thwarted further malicious activities. Such proactive approach helps maintain trust and demonstrates commitment to data protection, even if formal disclosure isn’t required,”

While I applaud this organization for shutting this down, it still blows my mind that the threat actors tried as hard as they did to try and set up shop and steal data. This illustrates why you need robust, multi layered defences to not only keep the bad guys out, but to respond if they get in.

In November 2023, Cybernews researchers discovered an openly accessible storage with over 1.5 million sensitive files. The files contained personal employee information and operational data from multiple energy companies. 

The research team has been able to attribute the leak to WorldLive LLC, a Louisiana-based company that specializes in tracking employee training, managing assets, and creating maintenance schedules for energy companies.

Some of the examined files were connected to ExxonMobil and Guyana Revenue Authority, JP Oil Holdings, Broussard Brothers, and Noble Energy, acquired by Chevron Corporation. However, given the scope of the leak, more companies could be affected.

The leak was caused by missing authentication on Azure Cloud Storage Blob – a cloud-based service from Microsoft Azure that allows users to store and manage large amounts of unstructured data such as text, binary data, and media files.

The leaked data includes:

• Employee names 
• Addresses
• Phone numbers
• Dates of birth
• Social Security numbers (SSN)
• Physical examination and drug test forms
• Scanned documents
• Employee certificates
• Templates for employee cards
• Employee resumes with photos
• On-site assessment forms with photos of critical infrastructure

The risk of attacks

Cybersecurity neglect by the companies’ service provider is highly concerning, as the energy sector is considered a critical infrastructure. Apart from the devastating effects in the case of an attack, the sector is highly targeted by malicious actors.

For the full report, visit: https://cybernews.com/security/worldlive-oil-rig-data-leak/