Heimdal Security Blog

A Data-trading Forum Allegedly Sells Emails Belonging to Lithuanian Ministry of Foreign Affairs

It appears that certain threat actors have in their possession 1.6 million emails holding extremely sensitive official papers and conversations that belong to the Lithuanian Ministry of Foreign Affairs.

However, the diplomatic institution didn’t make any comments on the matter hence we don’t know for sure whether the stolen emails that are being available for purchase on a data-trading forum are authentic.

It seems that some of the stolen documents, emails, and messages that were allegedly sent or received by the Lithuanian Ministry of Foreign Affairs staff have been leaked online in order to temp prospective customers.

The files shared by the hacker were supposedly email records of conversations from the most important officials of Lithuania’s embassy in Georgia. Apparently, some inboxes have more than 10 years of correspondence.

Lithuanian Ministry of Foreign Affairs’ Secrets on Sale?

According to BleepingComputer, the seller stated the cache holds 102 PST files (Outlook Data File) converted from OST data (Offline Outlook Data File – email backups) and is around 300GB large.

But the seller didn’t stop here declaring that the emails included confidential negotiation, the Belarus war planning, and secret stratagems against the American president Joe Biden.

Source

Last week, the Lithuanian Ministry of Foreign Affairs declared:

The Ministry of Foreign Affairs is unable to confirm the veracity of the information disseminated to the public and will not comment. We see this as an information attack by unfriendly countries.

Source

It is not the first time when the diplomatic institution experiences a cyberattack. Last year in November, it had fallen victim to an attack believed to have been conducted by Russia-based threat actors. Lithuanian Ministry of Foreign Affairs decided not to disclose the incident.

President of the Republic of Lithuania, Gitanas Nausėda declared they have evidence showing that all this information has been stolen in the November attack and that some of it is considered top secret.

Even if we don’t know yet how much the seller asks for the stolen information we do know there are individuals willing to purchase it.

According to BleepingComputer, the malicious actors announced that they were increasing the price, probably because so many people are interested in buying it.