{"id":21907,"date":"2023-05-03T04:30:05","date_gmt":"2023-05-03T12:30:05","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/05\/03\/news-15638\/"},"modified":"2023-05-03T04:30:05","modified_gmt":"2023-05-03T12:30:05","slug":"news-15638","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2023\/05\/03\/news-15638\/","title":{"rendered":"BlackCat group releases screenshots of stolen Western Digital data"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/images.idgesg.net\/images\/idge\/imported\/imageapi\/2023\/04\/03\/22\/my-cloud-home-100939321-small.jpg\"\/><\/p>\n<p><strong>Credit to Author: avenkat@idg.com| Date: Wed, 03 May 2023 04:20:00 -0700<\/strong><\/p>\n<p><a href=\"https:\/\/www.csoonline.com\/article\/3236183\/what-is-ransomware-how-it-works-and-how-to-remove-it.html\">Ransomware<\/a> group BlackCat has released a set of screenshots on its leak site that it claims are from data stolen from Western Digital in an April system breach. The images include screenshots of videoconferences and internal emails of the storage device manufacturer, according to a <a href=\"https:\/\/twitter.com\/AlvieriD\/status\/1652084141125431300\" rel=\"nofollow\">tweet<\/a> by cybersecurity researcher Dominic Alvieri.<\/p>\n<p>The screenshots also included an image of a recent meeting held by Western Digital where the company was discussing how to respond to the cyberattack. The ransomware group, along with the image, wrote, \u201cwith the finest threat hunters Western Digital has to offer.\u201d The images of the participants were blurred.<\/p>\n<p>Western Digital <a href=\"https:\/\/www.businesswire.com\/news\/home\/20230402005076\/en\/Western-Digital-Provides-Information-on-Network-Security-Incident\" rel=\"nofollow\">disclosed<\/a> it had suffered a network breach on April 3. The incident was first identified by the company on March 26 and the company revealed that an unauthorized third party gained access to several of the company\u2019s systems.<\/p>\n<p>\u201cBased on the investigation to date, the Company believes the unauthorized party obtained certain data from its systems and is working to understand the nature and scope of that data,\u201d Western Digital said.<\/p>\n<p>The company also said that it was taking down certain systems and services offline as a proactive security measure. Following the incident, several users <a href=\"https:\/\/twitter.com\/iricigor\/status\/1642647923707060225\" rel=\"nofollow\">reported<\/a> that they were not able to access Western Digital\u2019s <a href=\"https:\/\/www.networkworld.com\/article\/3256207\/what-is-nas-network-attached-storage-and-how-does-it-work.html\">network-attached storage<\/a>\u00a0service My Cloud.<\/p>\n<p>\u201cWe are currently experiencing a service interruption that is preventing customers from accessing the My Cloud, My Cloud Home, My Cloud Home Duo, My Cloud OS 5, SanDisk ibi, SanDisk Ixpand Wireless Charger service,\u201d the company said on April 3. The services were restored on April 12, according to the company&#8217;s <a href=\"https:\/\/status.mycloud.com\/os4\" rel=\"nofollow\">status<\/a> page.<\/p>\n<p>Along with the screenshots that BlackCat currently posted, the group also posted a note that states it would release more data and eventually put Western Digital\u2019s intellectual property on sale.<\/p>\n<p>\u201cBeginning next week on an unspecified day, we will share leaks every week until we lose interest. Once that happens, we will put their intellectual property up for sale, including code signing certificates, firmware, personally identifiable information of customers, and more,\u201d BlackCat said, adding that the group had obtained a full backup of Western Digital\u2019s SAP Back Office, which dates back to the last week of March.<\/p>\n<p>The group also claimed it was doing so because Western Digital did not get in contact with them.\u00a0There has been no further update on the issue from Western Digital nor confirmation of any ransom demanded.<\/p>\n<p><a href=\"https:\/\/www.csoonline.com\/article\/3690734\/amazon-owned-ring-reportedly-suffers-ransomware-attack.html\">BlackCat,<\/a> also known as ALPHV, was the second most active ransomware group in 2022, according to cybersecurity conpany Malwarebytes. It was the first ransomware to be coded in the Rust programing language. In February, the ransomware group listed over 6GB of data allegedly stolen from the Munster Technological University in Ireland on its website.<\/p>\n<p>The Lehigh Valley Health Network disclosed on February 20 that it had been attacked by the BlackCat ransomware gang and stated that it would not pay a ransom. Following this, the gang posted pictures of nude cancer patients on its site. The pictures were clinical images used as part of radiotherapy.<\/p>\n<p><a href=\"https:\/\/www.csoonline.com\/article\/3694904\/blackcat-group-releases-screenshots-of-stolen-western-digital-data.html#tk.rss_security\" target=\"bwo\" >http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/images.idgesg.net\/images\/idge\/imported\/imageapi\/2023\/04\/03\/22\/my-cloud-home-100939321-small.jpg\"\/><\/p>\n<p><strong>Credit to Author: avenkat@idg.com| Date: Wed, 03 May 2023 04:20:00 -0700<\/strong><\/p>\n<p>The screenshots included an image of a meeting that was held by the company to discuss the response to the recent cybersecurity incident.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[11062,10643],"tags":[11172,3765],"class_list":["post-21907","post","type-post","status-publish","format-standard","hentry","category-computerworld","category-independent","tag-data-breach","tag-ransomware"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/21907","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=21907"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/21907\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=21907"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=21907"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=21907"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}