The IT Nerd

In an 8-K filing with the SEC, Bassett Furniture said it shut down some of its IT systems following a ransomware attack it discovered on July 10.

“The threat actor disrupted the Company’s business operations by encrypting some data files. As a result of the Company’s containment measures, which included shutting down some systems, the Company has not been, and, as of the date of this Report is not operating its manufacturing facilities.

“The Company’s retail stores and e-commerce platform are open, and customers are able to place orders and purchase available merchandise; however, the Company’s ability to fulfill orders is currently impacted,” Bassett Furniture said in the 8-K filing.

“[…] the incident has had and is reasonably likely to continue to have a material impact on the Company’s business operations until recovery efforts are completed,” Bassett Furniture admitted.

No ransomware group has come forward to take credit for the incident as of Tuesday afternoon.

Evan Dornbush, former NSA cybersecurity expert had this to say:

   “The 8-K disclosure does not explicitly make clear that Bassett has been prompted to pay a ransom and with none of the more notorious actors yet coming forward to claim credit, it could be the breach was by a newer operator appearing on to the scene without the refined processes seen by the more established groups.  

   “The cybersecurity community needs to do a better job of prohibiting new actors from emerging, ensuring manufacturing and retail sectors don’t have to experience downtime and face other material impacts.”

Stephen Gates, Principal Security SME, Horizon3.ai followed with this:

In Bassett Furniture’s recent Form 8-K filing with the SEC, the company announced a disruption in its operations due to a cyber incident. It appears that a threat actor may have gained a foothold inside the company’s business operations network, likely leading to a human-operated, ransom-based attack.

Considering the potential virtual connectivity between Bassett’s business network and its suppliers for ordering and fulfilling raw materials, I would recommend investigating the breach from the perspective that the attacker might have first gained access through a supplier’s network. This scenario is highly probable in today’s interconnect supply chains.

If this were the case, the attacker, once inside Bassett’s business system, would have likely escalated their privileges, moved laterally within the network, accessed critical data, and encrypted it as part of the ransom attack. Consequently, Bassett’s response appears to have included disconnecting their production network from the business network as a containment measure.

Manufacturers and organizations with supply chains must acknowledge that their cyber risk now extends to their suppliers as well. I highly advise organizations with supply chains to incorporate third-party risk management using continuous cyber risk assessments into their risk management plans. Autonomous cyber risk assessment technologies that provide continuous and affordable assessments are readily available to help meet these types of directives.

I said this yesterday. Companies can either spend money up front to protect themselves, or spend even more money after getting pwned. The choice is theirs.

Yesterday, a hacker with the alias “Emo”, leaked 21.1 GB of information on over 15 million users of the Atlassian-developed project management tool Trello.

According to the hacker, the data breach occurred in January 2024, including the following:

• 15,182,073 email addresses
• User IDs
• Usernames
• Full names
• Profile URLs
• Status information
• Various settings and limits
• Associated board memberships

Initially, the hacker used email addresses from already-breached databases and then expanded the attack. The hacker explained that Trello had an insecure API endpoint accessible without logins, allowing the hacker to link email addresses to Trello accounts, revealing user identities, resulting in the widespread breach.

“I originally was only going to feed the endpoint emails from ‘com’ (OGU, RF, Breached, etc.) databases, but I just decided to keep going with emails until I was bored. This database is very useful for doxing, find enclosed email address matched to full names and aliases matched to personal email addresses,” the hacker said.

Evan Dornbush, a former NSA cybersecurity expert offers comments:

   “Data disclosure like this is unfortunate.  The attacker was using an unauthenticated-yet-legitimate API call to obtain sensitive information. Considering we’re talking about text data, 21.2GB is a lot to leak.

   “For a long time, anomaly detection failed to live up to the hype.  Modern computational processing leveraging machine learning techniques in theory make alerting on these kinds of abnormal operating behaviors a reality.  If they can emerge onto the cybersecurity scene more aggressively, perhaps companies could more quickly detect this kind of behavior in the future.”

This is pretty bad. And Trello really has to not only explain how this specific hack happened, but what they are going to do to safeguard customer data going forward. Because a leak of this scale is completely unacceptable.