After initially disclosing a data breach that happened on March 26, WD has now confirmed that hackers obtained a copy of a database that contained “limited personal information” on the company’s online store customers.
This information includes names, billing and shipping addresses, email addresses and telephone numbers in addition to hashed passwords and encrypted partial credit card numbers. The company had informed the affected customers via email by May 5.
As the company works to fix the issue, its online store has been taken offline stating that they’re offline and cannot process any orders at the time. WD hopes to restore access by May 15, 2023. Affected customers have also been warned to stay vigilant and watch for spearphishing attacks where the hackers might use the stolen information to trick customers for money or even more information.
After WD disclosed the attack, one hacker allegedly involved in the operation came forward claiming that the threat actors did extract roughly 10TB of customer data and that they were demanding an eight-figure ransom. WD’s original announcement did not have many details on the attack and the nature of the damages themselves, only stating that its network was breached by an unauthorised third party that was able to access multiple company systems.
The hacker went on to state that the group was trying to find ways to put more pressure on WD to cave and pay the ransom, including emailing WD executives proofs of access. The hackers’ demand was for a one-time payment, after which they would leave WD alone and inform them of the weaknesses in their networks. While no lasting damage was done to WD’s networks, the alleged hacker stated that any action against the group behind the attack would invite retaliatory action against WD.
While the group claims to not be associated with the Alphav ransomware gang, they did state that they’ll be using the ransomware group’s victim site to publish stolen data as they “know them to be professional”.
In the News: Meta allows hacked verified Facebook accounts to buy ads
