and we are meant to trust them with a CBDC.
https://www.techworm.net/2024/06/lockbit-33tb-u-s-federal-reserve-data-ransom.html
https://www.techworm.net/2024/06/lockbit-33tb-u-s-federal-reserve-data-ransom.html
Fed hacked 33 Tb data leak/Lockbit (ROFLMO)
- Thread starter Wellington
- Start date
- Status
Fortunately they can print some XMR to pay the ransom....
All kidding aside, I do not expect them to be breached. But I guess time will tell, the worst possible entity you could hit with ransomware is the US Gov. The last thing a ransomware operator would do in this case is NOT doxxing and NOT sharing proof.
All kidding aside, I do not expect them to be breached. But I guess time will tell, the worst possible entity you could hit with ransomware is the US Gov. The last thing a ransomware operator would do in this case is NOT doxxing and NOT sharing proof.
If you have Tor, here's the link to LockBit's official announcement:
http://lockbit3753ekiocyo5epmpy6klm...e2id.onion/post/7uTtXnLiP4aeqMqj6678851e3c73e
http://lockbit3753ekiocyo5epmpy6klm...e2id.onion/post/7uTtXnLiP4aeqMqj6678851e3c73e
If true I am trying to understand what they want to achieve. Do they just want kudos? It cant be money as they claim as there are much softer targets than going after an entity with near unlimited resources to deal with you.
why would the Fed website or database have any banking info of any Americans? this info is in the banks databases in their respective datacenters, isn't it? pls don't tell me this all is also on AWS or Azure cloud in addition to being in the DB of the Fed 😵 just weird. How so much data can be concentrated in one location.
They want it known that LockBit is able to breach high-value targets. This in turn makes them interesting for other players in the ecosystem, thus recruiting more people for their Ransomware as a Service offering. If you are able to breach a network, just give the guys from LB a call and they will help you︀ out type of deal.
A lot of banking︅ information is already in the cloud, most of it is hybrid. Legacy banking stuff is︆ kept on-premise while new innovation is deployed on the cloud. Also most critical organizations got︇ their own 'private' cloud within the hyperscalers and even dedicated physical connections to e.g. Microsoft︈ datacenters from their own DCs.
Funnily enough, they pass every Privacy Impact Assessment.
A lot of banking︅ information is already in the cloud, most of it is hybrid. Legacy banking stuff is︆ kept on-premise while new innovation is deployed on the cloud. Also most critical organizations got︇ their own 'private' cloud within the hyperscalers and even dedicated physical connections to e.g. Microsoft︈ datacenters from their own DCs.
Funnily enough, they pass every Privacy Impact Assessment.
They published it now .
The files are related to evolved banking .
https://www.federalreserve.gov/newsevents/pressreleases/enforcement20240614a.htm
The files are related to evolved banking .
https://www.federalreserve.gov/newsevents/pressreleases/enforcement20240614a.htm
with a tinfoil hat on: things like that are needed to bring in the cbdc system and undermining trust of the old one.
Wise USD account, and Mercury use it, but don't know by which extent, possibly Mercury is a tech layer on top of Evolve bank. What it seems from the email signature "Mercury is a financial technology company, not a bank. Banking services provided by Choice Financial Group and Evolve Bank & Trust®; Members FDIC."
And Wise works with many banks so they'll easily switch if needed. The notice seems "make better security please!" than anything important though, "The Board is requiring the bank to improve its policies and programs in those areas, in addition to requiring other remedial improvements".
But does it mean︀ Evolve bank is the ones whos customers go leaked or what?
but yeah actually could︁ easily be a play towards CBDC rollouts in order to point out "remember those scary︂ hacks? that's all in the past! since no one can hack the shiny new digital︃ money, yay!" strategy?
And Wise works with many banks so they'll easily switch if needed. The notice seems "make better security please!" than anything important though, "The Board is requiring the bank to improve its policies and programs in those areas, in addition to requiring other remedial improvements".
But does it mean︀ Evolve bank is the ones whos customers go leaked or what?
but yeah actually could︁ easily be a play towards CBDC rollouts in order to point out "remember those scary︂ hacks? that's all in the past! since no one can hack the shiny new digital︃ money, yay!" strategy?
I believe, once its in the public domain it's ok to publish.
What services were using : Bancorp?
What services were using : Bancorp?
Looks like they provide enough for an actual ACH pull by the hackers ns2 . Luckily I don't keep money in Mercury, but here's their email from 8 hours ago:
-----------
We recently became aware of a cybersecurity attack that breached the security systems of one of our partner banks, Evolve Bank & Trust, and leaked their records, including some account numbers, deposit balances, business owner names, and emails associated with Mercury and other fintech accounts.
Mercury account credentials , including passwords , were not exposed (we do not share this information).
While we do not anticipate an increased risk of exposed Evolve account numbers being used︀ fraudulently, Mercury is taking the following preventative steps to keep your funds secure:
----------------
-----------
We recently became aware of a cybersecurity attack that breached the security systems of one of our partner banks, Evolve Bank & Trust, and leaked their records, including some account numbers, deposit balances, business owner names, and emails associated with Mercury and other fintech accounts.
Mercury account credentials , including passwords , were not exposed (we do not share this information).
While we do not anticipate an increased risk of exposed Evolve account numbers being used︀ fraudulently, Mercury is taking the following preventative steps to keep your funds secure:
- We have︁ robust monitoring for suspicious ACH pulls. If you notice a fraudulent ACH pull initiated against︂ you, please dispute the transaction as soon as possible. You can see recent ACH pulls︃ here.
- You can further enhance the security on your accounts by enabling the ACH︄ authorizations feature, which will flag any ACH pulls from unauthorized vendors and give you a︅ chance to decline them before they are processed.
----------------
I can confirm that Airwallex, which also uses Evolve Bank & Trust, sent a︇ similar e-mail to customers yesterday in the evening:
************
Important Information Regarding Evolve Bank &︈ Trust Data Breach
We are writing to inform you of a cybersecurity incident involving Evolve︉ Bank & Trust, one of several Airwallex banking partners in the U.S. It appears that︊ a criminal organization targeted Evolve and leaked customer data, likely including Personal Identification Information (PII),︋ on the dark web. The data varies by individual, but could include your name, Tax︌ ID, date of birth, account information and/or other personal information.
At this point, we are︍ unable to confirm whether Airwallex customer data was compromised. Evolve has confirmed that they have︎ contained the situation and the bad actors are no longer in their system. However, we️ cannot independently assess the data and must work through Evolve and law enforcement to do so.
We are in contact with the Evolve team as they continue to investigate and analyze the situation. We will continue to share relevant updates as soon as we are able.
The security and safety of our customers’ data is of the utmost importance and we are increasing our monitoring of customer accounts connected to Evolve amid this situation.
We will be in touch as soon as we have more information to share any remediation actions that may be necessary. In the meantime, please notify us of any suspicious activity in your account and reach out to Airwallex customer service with any questions.
*****************
************
Important Information Regarding Evolve Bank &︈ Trust Data Breach
We are writing to inform you of a cybersecurity incident involving Evolve︉ Bank & Trust, one of several Airwallex banking partners in the U.S. It appears that︊ a criminal organization targeted Evolve and leaked customer data, likely including Personal Identification Information (PII),︋ on the dark web. The data varies by individual, but could include your name, Tax︌ ID, date of birth, account information and/or other personal information.
At this point, we are︍ unable to confirm whether Airwallex customer data was compromised. Evolve has confirmed that they have︎ contained the situation and the bad actors are no longer in their system. However, we️ cannot independently assess the data and must work through Evolve and law enforcement to do so.
We are in contact with the Evolve team as they continue to investigate and analyze the situation. We will continue to share relevant updates as soon as we are able.
The security and safety of our customers’ data is of the utmost importance and we are increasing our monitoring of customer accounts connected to Evolve amid this situation.
We will be in touch as soon as we have more information to share any remediation actions that may be necessary. In the meantime, please notify us of any suspicious activity in your account and reach out to Airwallex customer service with any questions.
*****************
It appears wise was impacted
|
Just a question: Do you think that this Federal Reserve Board enforcement action is somehow related to the Federal Reserve System breach that is discussed here? Honestly, I do not see any obvious link...
(Of course, this enforcement action is of a serious concern anyway; and thanks for sharing!)
(Of course, this enforcement action is of a serious concern anyway; and thanks for sharing!)
- Status