Sony’s Battle Against Hackers: Investigating Stolen Data for Sale

Sony Investigating After Hackers Offer to Sell Stolen Data

Sony, the Japanese electronics and entertainment giant, has launched an investigation after a cybercrime group claimed to have compromised the company’s systems and offered to sell stolen data. The group, known as RansomedVC, listed Sony on its Tor-based website and provided several files as evidence of their claims. While Sony is currently investigating the situation, there is no confirmation as to whether all Sony systems have been compromised.

The Claims and Evidence:

The cybercriminals from RansomedVC have made bold claims about their attack on Sony. They have stated that they will not be requesting a ransom payment but instead will sell the stolen data since Sony is unwilling to pay. To support their claims, they have provided several files, including Java files and screenshots that allegedly show access to source code and applications related to Sony‘s Creators Cloud media production solution. One PowerPoint slideshow marked ‘confidential’ and dated 2017 has also been leaked. However, the majority of the leaked files appear to originate from servers associated with Creators Cloud, and there is no evidence that all Sony systems have been compromised at this time.

The Nature of Cybercrime Groups:

It is not uncommon for cybercrime groups to make exaggerated claims about their attacks. In this case, intelligence group VX-Underground has reported that RansomedVC did not deploy file-encrypting ransomware or steal any corporate data. Instead, they managed to exfiltrate data from various development systems. This highlights the need for cautious skepticism when evaluating the credibility of such groups. It is crucial to investigate thoroughly before jumping to conclusions or taking action based solely on the claims of the attackers.

The Approach of RansomedVC:

RansomedVC stands out among other cybercrime groups due to its novel approach to extortion. They utilize data protection laws like the EU’s General Data Protection Regulation (GDPR) to justify their attacks and pressure victims to pay up. Their activities were brought to the attention of cybersecurity firm Flashpoint, who advised caution due to the group’s unverified claims. This demonstrates the evolving tactics used by cybercriminals and the need for organizations to stay informed and adapt their security measures accordingly.

Other Victims and Non-Targeted Organizations:

RansomedVC has listed nearly 40 victims on its website, with ransom demands ranging from a few thousand dollars to $1 million, depending on the organization’s size and revenue. It is worth noting that the group claims they do not target Russian and Ukrainian organizations, as most of its members are from these countries. While there is no confirmation of this claim, it indicates that attackers may have codependent relationships or affiliations that can influence their selection of targets.

Sony‘s Response and the Way Forward:

Sony has launched an investigation into the alleged data breach and is working to determine the extent of the compromise. As of now, the company has not provided further details or comments on the matter. It is essential for Sony to collaborate with cybersecurity professionals and experts to mitigate any potential damage and prevent future attacks. They should thoroughly assess the security of their systems and implement robust measures to safeguard against cyber threats.

Furthermore, this incident serves as a reminder to all organizations, regardless of size or industry, to prioritize cybersecurity. Continuous monitoring, strong access controls, regular system patching, and employee training are critical components of a comprehensive cybersecurity strategy. It is also vital for organizations to stay informed about emerging threats, collaborate with experts, and proactively address vulnerabilities to minimize the risk of falling victim to cyberattacks.

Conclusion:

The ransomware group’s claim of compromising Sony‘s systems and offering to sell stolen data is a concerning development. While the extent of the breach is still under investigation, it is crucial for organizations like Sony to respond promptly, working closely with cybersecurity experts to assess the impact and take necessary actions. This incident also highlights the ever-evolving nature of cyber threats and the need for organizations to stay vigilant, adapt security measures, and prioritize the protection of sensitive data.

Sources:

SecurityWeek: RansomedVC: Ransomware Promoting a New Extortion Approach