The hackers behind the Maze ransomware have released payment card data stolen from the Bank of Costa Rica (BCR) and are threatening to release similar files every week. The hackers claim they did this because they had previously breached the bank's systems , but BCR has not admitted to having been attacked.
The leaked files contain valid data
In a post on their site this week, the Maze published a 2GB spreadsheet containing payment card numbers from Costa Rican bank customers.
The attackers say they released the data because they don't want to make a profit from it. What they want is to draw attention to the bank so that it can more effectively protect its customers' sensitive information
The hackers' post is accompanied by several screenshots of the database ,which show unencrypted card numbers. In total, the images contain data for at least 50 cards (some listed multiple times). Previously, they had published parts of 100 credit card numbers (with the last four digits removed), along with the card's expiration date and verification codes.
The checks that were carried out showed that the data is valid, and that these are Visa or MasterCard debit cards issued by BCR bank.
On April 30, the Maze ransomware hackers claimed to be in possession of more than 11 million BCR bank customer cards.
The Maze team said it gained access to the bank's network in August 2019 and February 2020, to check whether security had improved.
They chose to exit without encrypting the systems the second time because “it was at least a mistake during a global pandemic” and “the potential damage was too high.” However, they did not remain completely idle.
BleepingComputer contacted BCR on May 1 to confirm one of the two incidents, but did not receive a response. However, the bank issued a public statement that day, saying that after an “exhaustive investigation” they could “confirm that the institution’s systems have not been compromised.”
In response, Maze released a spreadsheet four days later detailing systems it claimed originated from the BCR network. On May 21, they also released the card data
The bank made another statement on May 22, reiterating that multiple analyses by experts, both inside and outside the bank, confirmed that there was no access to the systems and that customer transactions were not affected.
The Maze group demanded a ransom from the bank. Although it did not encrypt the systems, it wanted to highlight vulnerabilities in the network .
