Tag Archive for: criminals

Should businesses negotiate with ransomware criminals? 

/in


By David Trump, above, Cyber Security Director, BOM IT Solutions 

Since the beginning of 2023, household names such as Royal Mail, Arnold Clark, WH Smith and Uber have all fallen victim to cyber-attacks. The reality is, however, these are just a few of the high-profile names that make up thousands of UK businesses and organisations that have been targeted by cybercriminals in the first quarter of the year. 

Ransomware is one of the most common types of malwares used in cyber-attacks. These attacks involve cybercriminals blackmailing victims in order to extort large amounts of money from them, usually in exchange for stolen data being returned, unencrypted, or the promise that it won’t be released publicly. Other ransom threats also include locking organisations out of critical systems, causing untold disruption to customers and potentially leaving reputations in tatters. 

Last year one in four SMEs experienced a ransomware attack, and during the first half of 2022, there were 236.1 million of these types of attacks worldwide. The costs associated are eyewatering too. According to IBM’s 2022 report, the average ransom payment is $812,360, or £650,000. However, this is only part of the total cost. When taking into account disruption, downtime and loss of business, IBM puts the average cost per attack at $4.5 million, nearly £4 million. In the UK, businesses should note they will also be liable to fines from the ICO for breaching GDPR guidelines should they fall victim to an attack where data is stolen. This can be up to 4% of global revenue. 

It’s not all doom and gloom, however, and there may be some light at the end of the tunnel in how organisations are responding. While an ever-greater number of companies are being held to ransom, the amount of money cyber gangs are managing to extort from victims is in decline. 

The amount paid to cyber criminals last year totalled $456.8 million (£402million), down from $765.6 million (£675million) the year before – a decline of over $300 million (£264million) in 12 months. While underreporting of costs and breaches can be commonplace, these figures definitely indicate a downwards shift. 

There are potentially a multitude…

Source…

Ransomware criminals dumping kids’ files online after school hack

/in


Nearly fourth months after an attack on Minneapolis Public Schools that dumped sexual assault case files online, administrators have not informed individual victims.

MINNEAPOLIS — The confidential documents stolen from schools and dumped online by ransomware gangs are raw, intimate and graphic. They describe student sexual assaults, psychiatric hospitalizations, abusive parents, truancy — even suicide attempts.

“Please do something,” begged a student in one leaked file, recalling the trauma of continually bumping into an ex-abuser at a school in Minneapolis. Other victims talked about wetting the bed or crying themselves to sleep.

Complete sexual assault case folios containing these details were among more than 300,000 files dumped online in March after the 36,000-student Minneapolis Public Schools refused to pay a $1 million ransom. Other exposed data included medical records and discrimination complaints.

Rich in digitized data, the nation’s schools are prime targets for far-flung criminal hackers, who are assiduously locating and scooping up sensitive files.

Often strapped for cash, districts are grossly ill-equipped not just to defend themselves but to respond diligently and transparently when attacked, especially as they struggle to help kids catch up from the pandemic and grapple with shrinking budgets.

Months after the Minneapolis attack, administrators have not delivered on their promise to inform individual victims. Unlike for hospitals, no federal law exists to require this notification from schools.

The Associated Press reached families of six students whose sexual assault case files were exposed. The message from a reporter was the first time anyone had alerted them.

“Truth is, they didn’t notify us about anything,” said a mother whose son’s case file has 80 documents.

Even when…

Source…

Ransomware criminals dump personal information of students online after stealing files from MN school

/in


The confidential documents stolen from schools and dumped online by ransomware gangs are raw, intimate and graphic. They describe student sexual assaults, psychiatric hospitalizations, abusive parents, truancy — even suicide attempts.

“Please do something,” begged a student in one leaked file, recalling the trauma of continually bumping into an ex-abuser at a school in Minneapolis. Other victims talked about wetting the bed or crying themselves to sleep.

Complete sexual assault case folios containing these details were among more than 300,000 files dumped online in March after the 36,000-student Minneapolis Public Schools refused to pay a $1 million ransom. Other exposed data included medical records and discrimination complaints.

Rich in digitized data, the nation’s schools are prime targets for far-flung criminal hackers, who are assiduously locating and scooping up sensitive files.

Often strapped for cash, districts are grossly ill-equipped not just to defend themselves but to respond diligently and transparently when attacked, especially as they struggle to help kids catch up from the pandemic and grapple with shrinking budgets.

Months after the Minneapolis attack, administrators have not delivered on their promise to inform individual victims. Unlike for hospitals, no federal law exists to require this notification from schools.

The Associated Press reached families of six students whose sexual assault case files were exposed. The message from a reporter was the first time anyone had alerted them.

“Truth is, they didn’t notify us about anything,” said a mother whose son’s case file has 80 documents.

US MARSHALS SERVICE ATTACKED BY RANSOMWARE TARGETING SENSITIVE LAW ENFORCEMENT INFORMATION

Even when schools catch a ransomware attack in progress, the data are typically already gone. That was what Los Angeles Unified School District did last Labor Day weekend, only to see the private paperwork of more than 1,900 former students — including psychological evaluations and medical records — leaked online. Not until February did district officials disclose the breach’s full dimensions.

The lasting legacy of school ransomware attacks, it turns out, is not in school closures,…

Source…

Ransomware criminals are dumping kids’ private files online after school hacks

/in


The confidential documents stolen from schools and dumped online by ransomware gangs are raw, intimate and graphic. They describe student sexual assaults, psychiatric hospitalizations, abusive parents, truancy — even suicide attempts.

“Please do something,” begged a student in one leaked file, recalling the trauma of continually bumping into an ex-abuser at a school in Minneapolis. Other victims talked about wetting the bed or crying themselves to sleep.

Complete sexual assault case folios containing these details were among more than 300,000 files dumped online in March after the 36,000-student Minneapolis Public Schools refused to pay a $1 million ransom. Other exposed data included medical records, discrimination complaints, Social Security numbers and contact information of district employees.

Rich in digitized data, the nation’s schools are prime targets for far-flung criminal hackers, who are assiduously locating and scooping up sensitive files that not long ago were committed to paper in locked cabinets. “In this case, everybody has a key,” said cybersecurity expert Ian Coldwater, whose son attends a Minneapolis high school.

Often strapped for cash, districts are grossly ill-equipped not just to defend themselves but to respond diligently and transparently when attacked, especially as they struggle to help kids catch up from the pandemic and grapple with shrinking budgets.

Months after the Minneapolis attack, administrators have not delivered on their promise to inform individual victims. Unlike for hospitals, no federal law exists to require this notification from schools.

The Associated Press reached families of six students whose sexual assault case files were exposed. The message from a reporter was the first time anyone had alerted them.

“Truth is, they didn’t notify us about anything,” said a mother whose son’s case file has 80 documents.

Even when schools catch a ransomware attack in progress, the data are typically already gone. That was what Los Angeles Unified School District did last Labor Day weekend, only to see the private paperwork of more than 1,900 former students — including psychological evaluations and medical records — leaked online….

Source…