The BBC reported a case of this kind at the end of March, tactfully avoiding the name of both the company and the individual. The only hints offered were that it was an American company and the individual in question was an IT director.
The ransomware gang in question was REvil, also known as Sodinokibi, though the Beeb did not say so.
Reporter Joe Tidy wrote on 30 March: "The targeted US firm has not publicly acknowledged that it was hacked. In its darknet blog post about the hack last month [February], the cyber-criminal gang named the IT director whose work computer allegedly contained the files.
|
|
"The infamous hacker group wrote: 'Thanks God for [named IT Director]. While he was [masturbating] we downloaded several hundred gigabytes of private information about his company's customers. God bless his hairy palms, Amen!'"
iTWire has come across a second such case, once again at a big American company. The firm was contacted several days ago, but has not written back.
On their dark web site, the ransomware gang — REvil again — behind the attack wrote: "We have a lot [of] private data from [name of firm] corporate. Contracts, Bill's, customers and employers personal data, tech datasheets, confidential projects and many many other.
"We was surprised what one of main corp IT Admin's is dirty wanker lol :) He rub his goose neck at his workspace. So if you very upset by this leak, just ask him - "for the f*** sake, man?"
Screenshots of a Windows machine showing the individual's name and also a screenshot of the password manager LastPass showing the individual's credentials for the well-known porn site PornHub were posted on the REvil site.
One security source told iTWire: "The problem is that, even though these screenshots could easily be faked, they could nonetheless convince a company to pay.
"Besides the embarrassment, you can see something like this pissing customers off so much that they decide to hit the company with a class action: 'Our personal info was exposed because the head of security was too busy wanking to do his job'.”
Ransomware gangs started with encrypting data from victims' machines and asking them to pay for the decryption key. Then they started leaking data, which meant that a ransomware attack also became a data breach and provided a second way to threaten victims.
After that there have been cases where the gangs have obtained phone numbers of customers and called them up, in order to again put pressure on the victims.
And now, they have turned to porn viewing habits to help extract their pound of flesh. But then again, perhaps people shouldn't be viewing porn at work...
