Omni Hotels confirms customers’ personal data stolen in ransomware attack – KIRO 7 News Seattle

/in


DALLAS — Officials with Omni Hotels & Resorts confirmed that cybercriminals stole the personal information of its customers during what appeared to be a ransomware attack last month.

>> Read more trending news

According to a post on its website on Sunday, the hotel giant said that “limited information pertaining to a subset of our customers may have been impacted.”

Omni said the stolen data includes customer names, email addresses, postal addresses and guest loyalty program information. The breach does not include information pertaining to financial information or Social Security numbers.

Omni said it shut down its systems on March 29 after discovering intruders in its systems, TechCrunch reported. Guests reported outages across Omni’s properties, with some customers experiencing issues with telephone and wi-fi issues, according to the technology news website.

Some customers said their room keys stopped working.

Omni officials said the chain’s systems were restored by April 8, TechCrunch reported.

“Omni Hotels & Resorts continues to investigate a recent cyberattack on its systems with the assistance of a leading cybersecurity response group,” the company wrote in an update on its website.

The FBI reported that more than 2,825 ransomware complaints were reported during 2023, an increase of 18% over 2022. Losses reported rose by 74%, from $34.3 million to $59.6 million, according to the agency.

Omni Hotels & Resorts is based in Dallas, and the chain operates 50 hotels and resorts in the United States and Canada, according to The Dallas Morning News.

© 2024 Cox Media Group

Source…

Exploited TP-Link Vulnerability Spawns Botnet Threats

/in


Endpoint Security
,
Governance & Risk Management
,
Internet of Things Security

Attackers Exploit Old Flaw, Hijack TP-Link Archer Routers

Prajeet Nair (@prajeetspeaks) •
April 17, 2024    

Exploited TP-Link Vulnerability Spawns Botnet Threats
Botnet are searching for unpatched TP-Link Archer AX21 routers. (Image: Shutterstock)

Half a dozen different botnets are prowling the internet for TP-Link-brand Wi-Fi routers unpatched since last summer with the goal of commandeering them into joining distributed denial-of-service attacks.

See Also: Cyber Hygiene and Asset Management Perception vs. Reality

Chinese router manufacture TP-Link in June patched a command injection vulnerability in its Archer AX21 router, a residential model that retails for less than $100. Consumer-grade routers are notorious for uneven patching, either because manufacturers are slow to develop patches or consumers don’t apply them. “Once they’re connected to the internet, they don’t care anymore about the router,” one industry CISO told Oxford University academics researching a 2023 paper.

The vulnerability, tracked as CVE-2023-1389, allows attackers to insert malicious commands by calling the “locale” API on the web management interface. Attackers use set_country to insert remote code since the unpatched routers don’t sanitize that input.

Researchers at Fortinet said Tuesday they’ve observed multiple attacks over the past month focused on exploiting the vulnerability – including botnets Moobot, Miori, the Golang-based agent “AGoent,” a Gafgyt variant and an unnamed variant of the infamous Mirai…

Source…

NCSC enters new partnership for PDNS delivery – National Cyber Security Centre

/in



NCSC enters new partnership for PDNS delivery  National Cyber Security Centre

Source…

Michigan healthcare organization says ransomware breached data of 185,000

/in


A ransomware attack in late 2023 exposed the personal data of nearly 185,000 people, a nonprofit Michigan healthcare organization reported Wednesday.

Cherry Street Services, also known as Cherry Health, said in a regulatory filing that the breach occurred on December 21 and was discovered on Christmas Eve.

The data breach notification filed with the office of Maine’s attorney general said the cause was ransomware, and that the attackers had accessed financial information such as credit card numbers and related security codes or passwords. 

So far Cherry Health has identified 184,372 potential victims. It has not specified the exact nature of the attack or the ransomware group involved. The organization did not immediately respond to questions from Recorded Future News. 

Cherry Health, based in Grand Rapids, operates in six Michigan counties and “offers high-quality health care to everyone, regardless of their ability to pay.” 

In early January the organization issued a statement citing a “network disruption,” and later in the month identified the event as a “cybersecurity incident.” It continued notifying potentially affected people in February. 

The 2023 holiday season saw several cyberattacks on healthcare institutions, including a Massachusetts hospital, a Seattle cancer center and an Australian provider. 

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

Source…