French energy and automation multinational Schneider Electric confirmed a breach of one of its developer platforms after a threat actor claimed to have infiltrated a substantial 40 GB of data. The incident reportedly involved Schneider’s Jira server, where sensitive project and user data were stored.
According to initial reports, the attacker infiltrated the server using exposed credentials and scraped extensive information via a REST API integration.
The company has activated its Global Incident Response to investigate and contain the breach.
“Our Global Incident Response team has been immediately mobilised to respond to the incident,” the company announced in a statement.
Schneider emphasised that its core products and services remain unaffected, with the breach contained within an isolated internal environment.
As Bleeping Computer reports, the attack was publicly disclosed by a threat actor known as ‘Grep,’ who took to social media over the weekend to claim responsibility. Grep indicated they had successfully accessed Schneider’s Jira server, a popular tool for tracking software development and project management workflows.
They allege that from there, they extracted over 400,000 rows of data, including 75,000 unique email addresses and associated personal details of Schneier Electric employees and customers.
The data theft was further detailed on the dark web, where Grep, representing a newly formed hacking group called the International Contract Agency (ICA), demanded a humorous ransom of $125,000 “in Baguettes” to avoid leaking the stolen data.
ICA, which Grep claims to have modelled after a fictional organisation in the Hitman: Codename 47 game series, reportedly does not actively extort companies. Instead, ICA has set a protocol whereby if the victimised organisation does not acknowledge the breach within 48 hours, it proceeds to leak any data obtained.
Now that Schneider Electic has confirmed the intrusion, it remains to be seen whether Grep and ICA will withhold the data or choose to publish it.
In the News: OpenAI in talks with California, Delaware on for-profit shift
