Cyber Consulting Company, Accenture, Hit by LockBit Ransomware Attack
August 2021 by SecurityHQ
Accenture, a global cyber consulting company providing management and consulting services, have been breached by a cyber threat using a strain of ransomware known as LockBit.
LockBit attacks are known for their ability to encrypt Windows domains by using Active Directory group policies. Once a domain is infected, new group policies are generated by the malware and sent to devices linked to the network. Here, the policies disable the antivirus security, and implement the malware. LockBit ransomware was first observed in September 2019, since then the malware has become significantly advanced, and once ransomware ads were barred on hacking forums, a new leak site was organized to showcase their latest variant, this being LockBit 2.0
Using LockBit 2.0, the attacker claims to have stolen over 6TB of Accenture’s data and is demanding $50M in exchange. LockBit operators claimed to have gained access to Accenture’s network and were preparing to leak files stolen from Accenture’s servers at 17:30:00 GMT. The hack was announced on the leak site, stating that:
“These people are beyond privacy and security. I really hope that their services are better than what I saw as an insider. If you’re interested in buying some databases reach us”
Accenture made a statement on Wednesday, stating that, "Through our security controls and protocols, we identified irregular activity in one of our environments. We immediately contained the matter and isolated the affected servers.”
They went on to say that, "We fully restored our affected systems from backup, and there was no impact on Accenture’s operations, or on our clients’ systems." However, with the level of controls, the clientele involved, and the possible data at risk, some are arguing that this is severely downplaying the breach. In fact, the ransom of $50m has still not been confirmed by Accenture and, with Accenture not answering questions regarding what had specifically been affected, if data had been accessed or even how much the ransomware demand was/is, no hard confirmation has been supplied by them yet.
On Thursday, Accenture said it did not have any updates to its initial statement.
Ransomware attacks are increasing by the day. You need to be prepared. Read our whitepaper on Ransomware Controls – SecurityHQ’s Zero Trust x40, for 40 recommendations to help your organisation safeguard against threats, both future and current. Reasonings behind each recommendation, with real-life examples and analysis of recent ransomware threats. And an exploration of “asymmetrical warfare” so that you can prepare yourself, your business, and your people for the increase in ransomware attacks that you will face.