On Thursday, US insurance company Genworth Financial disclosed that 2.5 million of its policyholders and customers had their data accessed in the hack, and California’s public pension fund said 769,000 of its members were impacted. Both revelations added to the fallout from a global hacking incident linked to Russian cybercriminals.
The information was released at the same time as consulting behemoths PwC and Ernst & Young announced they were looking into their exposure to the attack, one of the most significant data breaches involving a single piece of software in recent memory.
According to a regulatory filing by Genworth Financial, hackers gained access to client information including Social Security numbers.
Despite continuing to “measure the impact” of the breach, the corporation stated that it “does not currently believe this incident will have a material adverse effect on its business, operations, or financial results.”
More than 755,000 of the California Public Employees’ Retirement System’s members had their Social Security numbers obtained, according to a separate public announcement.
According to the motor vehicle bureaus of Louisiana and Oregon, millions of people also had their Social Security numbers or other personal information stolen in the attack last week.
These target organizations claimed that MOVEit, a well-known file-transfer program, was used to hack them, although they did not specifically name Russian cybercriminals as the perpetrators of the attack. Federal officials have accused a Russian outfit called CLOP of using the software to launch a larger cyber attack.
The firms who control that data are experiencing escalating legal and security issues as a result of the broad breach. Businesses that have had their data stolen must decide whether to pay out dishonest thieves or risk having their sensitive client information posted online if they refuse to pay.
Although there haven’t been any indications of widespread identity theft linked to the data loss, businesses whose data was compromised are proactively providing credit monitoring to clients.
The controversy started in late May when it was claimed that CLOP took advantage of a MOVEit vulnerability, a file-transfer program used by thousands of businesses and government organizations worldwide. Government officials and commercial professionals rushed to remove the hackers from networks and reduce the amount of ransoms paid, which may, according to analysts, be used to fund other ransomware assaults.
In a statement provided to CNN on Thursday, PwC claimed that only a “small number of clients” had files affected by the attack, while Ernst & Young said that “the vast majority” of the company’s systems using the affected software “were not compromised.”
As initially revealed by CNN last week, the hackers reportedly gained access to data held by a number of federal departments, including the Departments of Agriculture and Energy.
For more such trending news and latest updates, visit the links provided below:
- More Than 40% Of Californians Consider The Economy As A Factor In Their Desire To Leave The State
- 4 Out Of 10 California Residents Say They Are Seriously Considering Leaving The State
The hackers have been known to demand tens of millions of dollars in ransom for data they have stolen or encrypted from corporate victims, despite the fact that no federal authorities have reported ransom demands.
A senior official with the Cybersecurity and Infrastructure Security Agency, Eric Goldstein, told CNN on Wednesday that “very few” of the business and non-government victims in the US have paid a ransom.
Charles Carmakal, chief technical officer of Mandiant Consulting, a Google-owned company hired by some victims to address the attack, claims that some victims have nonetheless paid the hackers. He declined to say how many victims, or how much money, have paid the ransom that he is aware of.
As the demand to protect consumer data increases, Carmakal projected that “some organizations will pay over time.”
According to Carmakal, organizations “should evaluate the value of the stolen data and the potential harm that can result from it being publicly exposed.”
A class-action lawsuit has already been filed against Progress Software, the US company that makes the MOVEit software, for allegedly failing to protect user data. However, the business has claimed that it swiftly looked into the flaw, released a security update, and provided advice to clients on how to stay safe.
If you have the California Examiner bookmarked on your browser, you will always have prompt access to all of the most recent news and other material.
