Hackers publish Hackney Council data online after 2020 attack
The suspected ransomware incident in October last year knocked a number of council services offline
Data stolen from Hackney Borough Council in a major cyber attack last October has been published online by the hackers responsible.
Cyber security experts working with the local authority have confirmed “a limited set of data” has now been published online, four months after hackers infiltrated its networks.
The truth about ransomware The scariest security horror stories of 2020 Ransomware gangs pretend to delete stolen data to extort victims twice, report warns
The council has said the data, the nature of which hasn’t been disclosed, wasn’t published on any widely available public forums and is not visible through conventional search engines.
This means the data has likely been published on the dark web; a common practice by some groups following a ransomware attack either as proof of an attack, or if a ransom is demanded but not paid.
“It is utterly deplorable that organised criminals chose last year to deliberately attack Hackney, damaging services and stealing from our borough, our staff, and our residents in this way, and all while we were in the middle of responding to a global pandemic,” said the major of Hackney, Philip Glanville.
“Now four months on, at the start of a new year and as we are all responding to the second wave, they have decided to compound that attack and now release stolen data. Working with our partners we will do everything we can to help bring them to justice.”
The attack on council services in October last year led to outages lasting several weeks. The payment portal for paying rent and service charge, for example, was still unavailable a month after the incident.
Glanville added the council is in contact with residents and staff about any risk to their personal data, and are working with its cyber security partners to assess the data and take action. The council has also been working with the National Cyber Security Centre (NCSC), National Crime Agency (NCA), and Information Commissioner’s Office (ICO).
Although the data hasn’t been fully examined, Hackney Borough Council is confident the vast majority of sensitive or personal information it holds hasn’t been affected.
The council hasn’t confirmed this was specifically a ransomware attack, although a handful of prominent cyber crime outfits have been known to publish their victims’ data on their own online platforms after an attack, which is accessible through the dark web.
DopplePaymer, for instance, published a sample of archive files online last year after hacking into a digital transformation company that boasts clients such as NASA and the Defense Information Systems Agency (DISA).
The tactic has also been commonly deployed by the Maze and Sodinokibi groups in the past as a blackmailing technique. The threat of publishing stolen material could potentially expose organisations to bad press, fines, and action by data regulators.
IT Pro asked Hackney Borough Council what internal measures it has taken following the incident in October, and whether it can confirm the attack involved ransomware.
-
Cisco sounds alarm over new Russian malware campaign hitting firms in US and EuropeNews UAT-11795 is weaponizing legitimate software such as WebEx and Zoom to dupe victims
-
Why doesn't more data produce better results?ITPro Podcast Riverbed CIO Fernando Castanheira talks about data and how businesses can use it better
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
