The IT Nerd

You might recall that threat actors Ransom House had claimed to have pwned auction house Christie’s a couple of weeks ago. At the time I said this:

It will be interesting to see what happens next as we’re only two days from the end of May. I’m pretty sure that this group will release some sort of data in retaliation for not getting paid. But not paying them is the correct course of action as cybercrime groups cannot be allowed to succeed in terms of extorting money from their victims.

Well we’re in June now and it seems that Ransom House has made good on its threat to release data because it appears that Christie’s didn’t pay up. I say that because a data breach notification from Christie’s has appeared.

On May 9, 2024, we discovered that we were the victim of a cybersecurity incident that impacted some of our systems.

As soon as we became aware of this event, we promptly took steps to secure our environment, launched an investigation, and engaged external cybersecurity experts to assist. We also notified law enforcement and continue supporting their investigation.

The investigation revealed an unauthorized actor accessed some of our systems and certain files stored therein between May 8, 2024, and May 9, 2024, and some files were copied from those systems on May 9, 2024. We conducted a robust review of the files to identify individuals whose information may have been impacted and worked to obtain addresses and notify them as quickly as possible after completing the review on May 30, 2024.

Christie’s claims the data that was swiped by Ransom House hasn’t been misused. Which by the way Ransom House claims that the data in question is full names, addresses, ID document details, and various other sensitive personal information of at least half a million clients of the auction house. But at the same time they’re offering up a free twelve-month subscription for the CyEx Identity Defense Total identity theft and fraud monitoring service. Which means that it’s only a matter of time before that information is used to launch secondary attacks. Which will be cold comfort to those who are affected by this.

Seeing as Christie’s is a British company, I wonder what British authorities are going to do. If they do decide to get involved in this, it might be something worth tuning in for.

The Los Angeles Unified School District (LAUSD) is currently investigating a threat actor’s claims that they are selling stolen databases containing sensitive information belonging to millions of students and thousands of teachers. LAUSD, which is the second largest public school district in the United States, had more than 563,000 students enrolled for the 2023-2024 school year.

According to the threat actor, the stolen data is being sold for $1,000 on a hacking forum. The data allegedly includes over 11GB of information, encompassing more than 24 million student records, over 24,000 teacher records, and approximately 500 records containing staff information. The hacker shared samples of the data to prove its legitimacy, which included around 1,000 student records complete with Social Security Numbers (SSNs), addresses, parent addresses, email addresses, contact information, and dates of birth.
 
The authenticity and recency of the data remain uncertain as the threat actor only shared a small portion of the allegedly stolen information. There might be new information that has not yet been disclosed.
 
“We are looking into this and will get back to you if we have further information to share,” said LAUSD Public Information Officer Britt Vaughan in a statement to BleepingComputer.
 
In a related incident, LAUSD was hit by a ransomware attack in September 2022 over the Labor Day weekend. The Vice Society gang claimed responsibility for that breach, claiming they stole 500GB of files before encrypting the district’s systems.
 
Following the 2022 attack, LAUSD mandated all employees (teachers, support staff, and administrators) as well as students, reset their @LAUSD.net account credentials in person at a district site and expedited the rollout of multi-factor authentication.

Steve Hahn, Executive VP, BullWall has this to say:

   “The threat landscape has taken a sinister turn in the last few years, partly because these (mostly) Russian based threat actors consider our support of Ukraine an act of war and also because of the financial stakes. This is a multi-billion-dollar industry now. However recent years has seen the threat actors intentionally targeting young children for extortion and blackmail, which is precisely what this. It’s unconscionable.

   “Threat actors target schools with “dual extortion” techniques. They exfiltrate data on students and encrypt all of the school’s data in a sequenced attack. The school will have to pay to not have that data leaked and pay again to get it decrypted. The information they can get in an attack like this is devastating to the children involved. Information about their grades, sexual activity, medications or mental healthcare, domestic violence, sexual orientation or identity and disciplinary actions. When this gets leaked parents will be, rightfully, outraged and the political fallout severe. The threat actors know this and seem to disregard the impact on the well-being of the targeted children.

   “Unlike big corporations or other government services, schools simply don’t have the resources or personnel to prevent these attacks. It is not a matter of “if” a school district will be hit but “when” and the funding bodies don’t seem willing to allocate pro-active funding until they’ve been hit and see first-hand the fallout. However, even with the best prevention tools in the world a determined threat actor will eventually break through.

   “Schools need to limit the sensitive information they document and retain. They need recovery strategies for the eventuality and need to also focus on rapid containment of the event to limit the amount of data impacted. It is also important to hold tabletop exercises to create a playbook for what happens when they eventually do get hit. How Legal, Boards and City Councils will be involved. These exercises often open up the eyes of the city councils to just how impactful these events are.”

Dave Ratner, CEO, HYAS follows with this:

“Schools and universities are increasingly becoming common targets, both because of the treasure trove of data they contain and their overall cyber security posture, which is unfortunately often less than perfect based on limited budgets. It’s imperative that those in the education sector prioritize cyber security hygiene — often this can be accomplished in a budget-friendly manner via one of the many MSP and MSSPs that focus on best practices.”

It will be interesting to see if these claims of LAUSD being pwned again are true. If they are, then LAUSD will have to do a lot of hard work to make sure that threat actors don’t go three for three so to speak.