Extorting the afterlife? Hackers breach cemetery, stealing personal data
As if there was a lack of proof that ransomware gangs would target anyone, threat actors pushed the bar even lower, adding a cemetery to their list of victims.
Image by Cybernews.
As if there was a lack of proof that ransomware gangs would target anyone, threat actors pushed the bar even lower, adding a cemetery to their list of victims.
One of the most prolific ransomware cartels currently in operation, INC Ransom, apparently managed to hack a cemetery. The gang recently added The Catholic Cemeteries of the Diocese of Hamilton in Canada to their dark web forum, used to showcase its latest victims.
As is usual in ransomware attacks, threat actors shared samples of the allegedly stolen data. The Cybernews research team cautiously investigated the sample, finding that attackers shared various documents and personal details.
According to the team, the leaked details include:
- Financial documents
- Territory plans
- Contracts
- Names
- Dates of birth
- Employee pay slips
More from Cybernews
Sainsbury’s installs more facial rec tech in stores: Should shoppers be worried?
"Phantom squatting” uses AI hallucinated domains for cyber attacks
What they’re doing to gamers is a robbery in broad daylight
Irish parliament expands Microsoft use, despite the EU’s efforts to ditch it
Can government AI actually scrub UAP footage from the internet?
The EU and Apple CEO Tim Cook held "constructive" talks after their Siri AI dispute in Europe
At least in theory, attackers could use these details against grieving customers for financial fraud and targeted scams. Threat actors could target grieving relatives, impersonating the funeral service provider, and tricking individuals into revealing sensitive personal information.
Meanwhile, INC Ransom is one of the most prominent ransomware cartels currently operating. First observed in July 2023, the cyber cartel has been inching towards the top, with victims like a DoD defense contractor, Stark AeroSpace, the San Francisco Ballet, the City of Leicester in England, the NHS Dumfries and Galloway Health Board of Scotland, and the Xerox Corporation on its list.
According to Cybernews’ dark web monitoring tool, Ransomlooker, INC Ransom has victimized at least 163 organizations over the past 12 months.
The gang is considered a multi-extortion operation – which means it not only encrypts and steals data but also threatens to publish it online if the victim doesn’t pay up. It appears to target a varied number of industry sectors at random, including attacks on the healthcare, education, and government sectors.
While it’s unclear where the gang members come from, the vast majority of their victims are based in Western countries. At the same time, the gang doesn’t target organizations from the Commonwealth of Independent States (CIS), a tactic shared by many Russia-based cybercriminals.
Some researchers believe that the Lynx ransomware cartel is an offshoot or a rebrand attempt of individuals related to the INC Ransom cartel.