Capcom has issued a new statement regarding the ransomware attack it suffered last year, detailing how hackers gained access to its network, compromised devices, and stole personal information belonging to thousands of people.
In early November 2020, the Ragnar Locker ransomware hit the Japanese video game developer and distributor, forcing it to shut down parts of its network. The Ragnar Locker gang claimed to have stolen 1TB of sensitive data from Capcom and then demanded an $11 million ransomto keep the stolen data and provide a decryption tool.
Read also: Dutch supermarkets run out of cheese after a ransomware attack
Capcom announced on April 13 that the restoration of internal systems affected by the attack is nearly complete and that the investigation into the incident is complete. Investigators discovered that the Ragnar Locker operators gained access to Capcom's internal network by targeting an old VPN backup device.
Thus, hackers gained access to devices located in the company's offices in the US and Japan and distributed the file-encrypting malware on November 1 , taking email and file servers offline . Here's a simplified depiction of the incident .
Capcom reported that it was in the process of strengthening its network defenses when the Ragnar Locker gang breached its network.
See also: Cring: New ransomware targets unpatched Fortinet VPN!
As the COVID-19 pandemic has led many employees to work remotely, the old VPN server continued to function as an emergency backup in case of communication problems. The company's final estimate of the data breach is that 15,649 people have been affected – 766 fewer than initially announced in January 2021.
The information exposed does not include payment card details, but only company and personal data (names, addresses, phone numbers, and email addresses). Capcom is currently notifying affected individuals.
As for the ransom, the game maker noted that the hackers left a message on the encrypted systems that did not mention any price, only instructions to contact them to initiate negotiations. Ransomware attacks rarely provide details about prices in ransom notes. More often than not, the notes provide victims with step-by-step instructions on how to contact the attacker to learn the ransom and initiate negotiations.
Suggestion: Windows XP forces ransomware gangs to work harder
Capcom reported that after consultations with law enforcement, it did not attract the operators of the Ragnar Locker ransomware nor attempted to communicate with them. This decision caused the hackers to leak the company's data a few weeks after the breach.
The research results published on April 13 show that the toy manufacturer was «hit» at a bad moment, when its efforts to transition to better defenses were slowed by measures to adapt to the COVID-19 pandemic.
Part of the increased security measures that Capcom took after the hacking attack is an operational security center (SOC) service that monitors external connections and an endpoint detection and response (EDR) system that checks for any unusual activity on computers and servers.
Information source: bleepingcomputer.com
