Auction.com: Potential Data Breach Under Investigation
On May 16, 2022, we learned that the Conti group had announced a data breach of Auction.com's computer systems, which purportedly took place on April 13, 2022.
(screenshot of the Conti data leak page for Auction.com as of May 16, 2022)
The group made 6.47 MB of data openly available on the dark web, representing it was a mere 1% of the Auction.com data the Conti group had taken. The Conti group has been linked to over 1,000 ransomware events.
(screenshot of the Conti data leak page for Auction.com as of May 16, 2022)
This story will be updated as more details become available.
For more information click here. Have questions? Feel free to contact us.
Agile Sourcing Partners Suffers Potential Data Breach Due to Conti Ransomware Attack
On May 16, 2022, we also learned that the Conti group had announced a data breach of Agile Sourcing Partners’ computer systems, which purportedly took place on April 2, 2022.
(screenshot of the Conti data leak page for Agile Sourcing Partners as of May 16, 2022)
The group made 2.67 MB of data openly available on the dark web, representing that this was only 1% of the data taken.
(screenshot of the Conti data leak page for Agile Sourcing Partners as of May 16, 2022)
More details on this breaking story coming soon!
The FBI and Other Federal Authorities Have Been Warning About the Conti Threat for 12 Months
Companies such as Auction.com and Agile Sourcing Partners have been warned for at least year to be on the lookout for ransomware attacks from the Conti ransomware group. The FBI issued a Flash Alert about Conti ransomware attacks in May, 2021. On September 22, 2021, a Joint Cybersecurity Advisory was disseminated with details about what red flags indicate a business has been compromised by Conti ransomware, and how attacks can be avoided.
“Americans are routinely experiencing real-world consequences of the ransomware epidemic as malicious cyber actors continue to target large and small businesses, organizations, and governments. CISA, FBI, and NSA work tirelessly to assess cyber threats and advise our domestic and international partners on how they can reduce the risk and strengthen their own capabilities."
(Eric Goldstein, Executive Assistant Director for Cybersecurity, CISA, CISA, FBI and NSA Release Conti Ransomware Advisory to Help Organizations Reduce Risk of Attack (Sept. 22, 2021).)
Even if a Company Elects to Pay the Ransom Demanded, Stolen Data Remains at Risk
Many companies elect to negotiate a ransom payment with hackers like the Conti gang to unlock their computer systems. Unfortunately, there is no guarantee that the personal data stolen by these groups will be returned. For this and other reasons, federal law enforcement groups, including the FBI, advise against paying ransoms. In fact, according to the Sophos State of Ransomware 2021 report, in 2021 a scant 4% of companies in who paid to end a a successful ransomware attack got all of their data back.
Businesses Should Be Held Accountable For Data Breaches
“With ransomware groups more active than ever, it is vital that companies stay abreast of the latest FBI advisories to avoid falling victim to these schemes and quickly recognize if they have been compromised.
Consumers who have trusted businesses with their sensitive financial and personal data deserve to have that data held securely, with the highest possible attention paid to preventing known threats.”
(April M. Strauss, senior California attorney and Certified Information Privacy Professional, Auction.com Data Breach Due to Conti Ransomware Attack (May 17, 2022).)
When businesses decide to collect and keep personal data about California residents, under California law they take on the obligation to protect that information and keep it safe from hackers, thieves, and other criminals. This personal data is incredibly valuable, both to businesses and to criminals who want to sell that information on the dark web to identity thieves and other black marketeers. The stakes are high: Data breach victims are more likely to also be victims of additional fraud.
California Privacy Laws Protect You
Several laws, including the California Consumer Privacy Act (CCPA), require businesses implement and maintain reasonable security when they collect and keep certain types of personal information, like Passport numbers and certain financial information. If that sensitive information is unencrypted and accessed, stolen, or hacked because a business failed to exercise reasonable security measures, an affected California resident can sue to protect their rights under the CCPA and other state laws.
If you are a California resident and your data has been compromised, the CCPA provides affected consumers may be entitled to between $100 and $750 or their actual damages, whichever is greater. Participants in data breach lawsuits can recover damages, injunctive relief (to make sure that the business has reasonable security practices to protect consumer data from being leaked again), and anything else the court concludes is necessary to compensate data breach victims and prevent these harms from reoccurring.
Experienced data breach and class action attorneys can help you exercise your rights, evaluate your options and decide whether you are entitled to compensation under the CCPA. There are no out of pocket costs to you, as we only get paid if we prevail.
If you are a California resident who believes your information has been affected by either of these Conti ransomware attacks and are concerned about this breach of your personal data and what your options are, simply fill out the following form.