The IT Nerd

From the “I can’t believe the scale of this” department, comes this story where Greece’s Land Registry has been hit by 400 cyberattacks that have resulted in what they call a “limited scale” data breach.

Mind. Blown.

I’m going to come back as to why my mind is blown. But first, here’s the relevant details:

The Land Registry agency in Greece has announced that it suffered a limited-scope data breach following a wave of 400 cyberattacks targeting its IT infrastructure over the last week.

The agency said hackers managed to compromise employee terminals and steal 1.2 GB of data, corresponding to roughly 0.0006% of the total data held by the government organization.

The stolen data reportedly does not contain any citizens’ personal information but primarily consists of typical administrative documents, the exposure of which is not expected to impact the registry’s operations.

The announcement also mentions that the hackers attempted to create a malicious user to infiltrate the agency’s central database, but they failed.

One of the database’s backups, which are updated daily, was accessed by the unauthorized actors. However, the subsequent attempt to exfiltrate the data to an external server was blocked.

The Land Registry’s internal investigation, aided by the Cybersecurity Directorate of the General Staff of National Defense, has not found any evidence of ransomware having been deployed on the breached systems.

Emergency actions to reduce the risk of ransomware have been taken, like terminating all VPN access to block malicious users.

Rogier Fischer, CEO, Hadrian had this comment:

“Based on the information provided, the data breach at the Land Registry agency in Greece doesn’t seem to fall under the GDPR’s mandatory disclosure bracket. The stolen data amounted to 1.2 GB or 0.0006% of the agency’s total data, and it primarily consisted of administrative documents without any citizens’ personal information,”

“Since the breach did not affect personal data or disrupt the agency’s operations, it likely doesn’t pose a significant risk to individuals’ rights and freedoms.”

“Despite the large number of cyberattacks, the agency successfully blocked attempts to exfiltrate data and thwarted further malicious activities. Such proactive approach helps maintain trust and demonstrates commitment to data protection, even if formal disclosure isn’t required,”

While I applaud this organization for shutting this down, it still blows my mind that the threat actors tried as hard as they did to try and set up shop and steal data. This illustrates why you need robust, multi layered defences to not only keep the bad guys out, but to respond if they get in.

In November 2023, Cybernews researchers discovered an openly accessible storage with over 1.5 million sensitive files. The files contained personal employee information and operational data from multiple energy companies. 

The research team has been able to attribute the leak to WorldLive LLC, a Louisiana-based company that specializes in tracking employee training, managing assets, and creating maintenance schedules for energy companies.

Some of the examined files were connected to ExxonMobil and Guyana Revenue Authority, JP Oil Holdings, Broussard Brothers, and Noble Energy, acquired by Chevron Corporation. However, given the scope of the leak, more companies could be affected.

The leak was caused by missing authentication on Azure Cloud Storage Blob – a cloud-based service from Microsoft Azure that allows users to store and manage large amounts of unstructured data such as text, binary data, and media files.

The leaked data includes:

• Employee names 
• Addresses
• Phone numbers
• Dates of birth
• Social Security numbers (SSN)
• Physical examination and drug test forms
• Scanned documents
• Employee certificates
• Templates for employee cards
• Employee resumes with photos
• On-site assessment forms with photos of critical infrastructure

The risk of attacks

Cybersecurity neglect by the companies’ service provider is highly concerning, as the energy sector is considered a critical infrastructure. Apart from the devastating effects in the case of an attack, the sector is highly targeted by malicious actors.

For the full report, visit: https://cybernews.com/security/worldlive-oil-rig-data-leak/

This isn’t a good look. The L.A. County Courts, as in all of them, have been shut down because they were hit with a pretty devastating ransomware attack:

The attack was detected Friday and doesn’t appear to be related to the CrowdStrike software update that paralyzed Windows computers around the world and affected governments, airlines and other agencies last week, court officials said in a Sunday news release. 

This closure extended to all 36 courthouses in the county, and officials did not expect it to last beyond Monday.

“While the Court continues to move swiftly towards a restoration and recovery phase, many critical systems remain offline as of Sunday evening,” presiding Judge Samantha Jessner said in the release. “One additional day will enable the court’s team of experts to focus exclusively on bringing our systems back online so that the Court can resume operations as expeditiously, smoothly and safely as possible.”

The affected court systems span the My Jury Duty Portal and the court’s website, as well as the court’s case management systems, according to the release.

Rogier Fischer, CEO, Hadrian had this to say:

It was prudent from the court’s side to clarify that the whole incident is unrelated to the Crowdstrike-Microsoft incident, noted Rogier Fischer, CEO of Netherlands-based cybersecurity company Hadrian.”Apart from the legal obligations, it becomes a moral obligation of the key stakeholders of a cybersecurity incident to clear the air and shut the possibilities of any form of miscommunication,” he said.According to him, organizations hit by a ransomware attack must immediately execute these basic defense steps: isolate the infected systems and notify the respective IT department, senior management, and relevant authorities such as the FBI or CISA.”Investigate the scope of the attack, document your actions, and carefully decide whether to pay the ransom, consulting legal counsel and cybersecurity experts. Finally, restore systems from clean backups, implement stronger security measures, and communicate transparently with stakeholders while reviewing the incident to improve future responses,” he added. 

It appears that even the justice system isn’t immune from cybercrime. Thus it reinforces that everyone needs to take action to make cybercrime less devastating than it is now.

Documents belonging to ClickBalance, Mexico’s largest Enterprise Resource Planning (ERP) technology providers, were exposed as reported by cybersecurity researcher Jeremiah Fowler.

What happened: 769,333,246 records with a total size of 395 GB were exposed. The database contained email addresses, API keys, IP addresses, payments indicating the bank name, account number, ID numbers, and much more.

Why it matters: A data breach of any company that provides ERP or data services can have severe potential long term consequences, as cyber criminals could exploit exposed credentials to gain unauthorized access to applications, databases, and other services.

If you want to know more about Jeremiah’s findings you can read the full report here: https://www.websiteplanet.com/news/clickbalance-breach-report/

UPDATE:  BullWall Executive, Carol Volk had this comment:

“There is no escaping our reliance on the supply chain. The fact that so many links in that chain have not even the most basic cyber defenses in place, assures us that our data will be used against us and our networks in future attacks. Being prepared for that eventuality is our only option if we wish to remain in business. 

   “With the average recovery cost from a ransomware attack exceeding $2.7 million in 2024, events such as the ClickBalance data exposure remind us that Cyber defensive systems are table stakes and not optional. Seriously, when your data is freely available to hackers, including access tokens, API keys, secret keys, bank account numbers, tax identification numbers, and email addresses, you’d better be following best practices in your defensive stack and make sure you’ve included a ransomware containment system for the day your exposed data comes back to attack you.”