After about three months, Canon publicly confirmed the ransomware attack it suffered in early August, which affected the company's servers and resulted in a data leak
BleepingComputer was the first to report the attack , after noticing a suspicious outage on the cloud photo and video storage service ( image.canon ) that caused users to lose files .
On August 5, Canon USA sent a company-wide notification informing employees that there were widespread system issues, resulting in many applications, groups, and emails being unavailable.
A screenshot of the ransom note obtained by BleepingComputer shows that the outage was caused by Maze ransomware, a group that typically steals data from affected networks to pressure victims into paying.
Canon began investigating the incident and found evidence of unauthorized activity on its network between July 20 and August 6.
The threat actor had access to file servers that also host “information on current and former employees from 2005 to 2020 and their beneficiaries and dependents.”.
Canon says the data the attacker accessed included employees' names, Social Security numbers, dates of birth, driver's license or state-issued ID numbers, bank account numbers for direct deposits from Canon, and their electronic signatures.
Shortly after the attack, Maze ransomware told BleepingComputer that it had stolen 10 terabytes of data and private databases from Canon before unleashing the malware on August 5th.
The Maze cybercriminal group was one of the biggest players in the ransomware arena. On November 1, the gang ceased its activities that had begun about a year and a half earlier, in May 2019.
It is responsible for the current trend of double extortion, used by most ransomware criminals today, where they steal data before encrypting it and threaten to leak it unless the victim pays the ransom. Among their victims are major companies such as Allied Universal, Southwire, City of Pensacola, Canon, LG Electronics , and Xerox.
