Ransomware extortion group ShinyHunters published the personal information of approximately 396,000 customers of Dutch business travel agency BCD Travel on the dark web in a recent extortion campaign. This move follows the travel company’s failure to meet the attackers’ ransom deadline.
-
Nearly 400,000 customer records were exposed.
-
ShinyHunters leaked data after ransom talks failed.
-
Names, emails, phone numbers and support tickets were included.
-
Stolen data allegedly came from multiple internal systems.
BCD Travel, headquartered in the Netherlands, is one of the largest business travel agencies in the world. It serves multinationals and government entities globally with planning business trips and related services, including booking flights, hotels, and rental cars.
At the end of May, ShinyHunters claimed to have exfiltrated over 30GB of compressed data. Allegedly, the stolen information included over 700K Salesforce records, as well as various SharePoint sites, internal documents, customer records, and business-related data such as contracts and operational intelligence.
The attackers gave BCD Travel until June 1st to come up with the ransom demand, or otherwise they would leak all the stolen information onto the dark web.
The deadline wasn’t met, and therefore, ShinyHunters published the stolen information.
According to Troy Hunt, a cybersecurity expert based in Australia, 396,313 unique email addresses have been leaked. The data also contained names, physical addresses, phone numbers, job titles, and support tickets.
Over a quarter of all leaked email addresses (28%) were already in the “Have I Been Pwned” database, Hunt says on X.
ShinyHunters is an infamous and well-known ransomware extortion group. Over the past few months, it has added many new names to its leak page, including telecom provider Odido, digital car dealer CarGurus, the European Commission, supplier of student information system Infinite Campus, and Canvas developer Instructure.
Not all victims paid the ransom to ShinyHunters. For example, Odido told the media on numerous occasions that it refused to negotiate with or pay the attackers.
Instructure, on the other hand, admitted to having paid off the hackers and claimed that all the stolen data was deleted.
Unlock more exclusive Cybernews content on YouTube.
Your email address will not be published. Required fields are markedmarked