The San Francisco 49ersis trying to recover from a cyberattack by ransomware gang BlackByte, which claims to have stolen data from the American football organization.
See also: BlackByte ransomware decryptor for file recovery for free
The 49ers confirmed the attack and said it caused a temporary outage in parts of their IT network.
While the 49ers did not confirm whether the attackers successfully deployed the ransomware, they said they are still in the process of recovering their systems, indicating that the devices were likely encrypted.
To carry out a ransomware attack, hackers breach a corporate network and silently spread to other devices while stealing data. This is a method often used in such attacks. They eventually deploy malware that encrypts all devices on the network, while leaving ransom notes demanding payment in cryptocurrency.
Ransomware gangs then use the stolen files to threaten the owners that they will leak them if the ransom is not paid.
See also: 2021: Organizations paid over $600 million to ransomware gangs
The BlackByte gang has claimed responsibility for the attack on the 49ers, as the team prepares for the 2022 Super Bowl, by beginning to leak files they claim were stolen from them.
The leaked data is a 292 MB file, which the malicious actors say contains stolen 2020 invoices from the 49ers' network.
BlackByte typically posts its victims' data publicly to further pressure them to pay up. While it's not known how much data was stolen during the 49ers attack, BlackByte has stolen gigabytes of data from previous victims.
The ransomware gang in question is known to use vulnerabilities to gain initial access to a corporate network, which highlights the need to always have the latest software updates installed.
See also: Avast: Free decryption tool for TargetCompany ransomware victims
In October 2021, BlackByte made the significant mistake of reusing the same decryption/encryption key in multiple attacks.
While BlackByte quickly fixed the bug, it allowed cybersecurity company Trustwave to create a free decryptor that allows some victims to recover their files for free.
