Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
A zero-day vulnerability in Crown Resorts’ GoAnywhere secure file-sharing server has led to a data breach at the largest gambling and entertainment company in Australia. The Blackstone-owned company operates complexes in Melbourne, Perth, Sydney, Macau, and London, and has an annual revenue that surpasses $8 billion.
During the past year, the Clop ransomware gang has shifted from encrypting files to performing data extortion attacks. The threat actors claimed to have stolen data from 130 organizations over ten days using a GoAnywhere zero-day vulnerability in February.
The company said on Monday that a ransomware group had contacted it, claiming to have accessed some files related to Australia’s largest casino operator through a data breach at GoAnywhere.
We are investigating the validity of this claim as a matter of priority. We can confirm no customer data has been compromised, and our business operations have not been impacted.
The company further says it will continue to work with law enforcement to investigate the security incident and will provide updates as new evidence emerges.
The GoAnywhere breaches have impacted a long list of victims, including CHS, Hatch Bank, Rubrik, the City of Toronto, Hitachi Energy, Procter & Gamble, and Saks Fifth Avenue.
Despite threatening to leak the data it stole from the victims’ networks, Clop has not yet published anything on its data leak site.
Vulnerabilities Lead to Lawsuit
According to Reuters, suspicious activity at GoAnywhere was identified nearly two months ago. Furthermore, BleepingComputer reports that the vendor of the GoAnywhere software, Fortra, is already facing the prospect of a class action lawsuit in the United States, accused of failing to implement adequate cybersecurity measures to protect the private data stored in its network. In spite of the fact that Fortra offered the plaintiff, a Hatch Bank customer, one year of free identity monitoring and fraud protection, the gesture was dismissed as insufficient to mitigate the lifetime risk of exposure to personal data.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, and YouTube for more cybersecurity news and topics.
