Digital security giant Entrust has confirmed that it suffered a cyberattack where threat actors breached its network and stole data from internal systems.
See also: Amadey malware: Distributed via SmokeLoader using cracks
Entrust is a security company focused on electronic trust and identity management, offering a wide range of services, including encrypted communications, secure digital payments, and identity issuance solutions.
Depending on the data stolen, this attack could impact a large number of critical and sensitive organizations that use Entrust for identity management and authentication.
This includes U.S., such as the Department of Energy, the Department of Homeland Security, the Department of Treasury, the Department of Health & Human Services, the Department of Veterans Affairs, the Department of Agriculture, and many others.
Hackers breached Entrust's network in June
About two weeks ago, a source told BleepingComputer that Entrust was breached on June 18th and that hackers stole corporate data during the cyberattack.
However, just yesterday the breach was publicly confirmed when security researcher Dominic Alvieri published a screenshot of a security alert sent to Entrust customers on July 6.
“I am writing to inform you that on June 18th, we learned that an unauthorized party had access to some of our systems used for internal operations. We have been working tirelessly to remediate this situation since that time,” reads a security alert from Entrust CEO Todd Wilkinson.
"The first thing I want to tell you is that, although our investigation is ongoing, so far we have found no indication that the issue has affected the operation or security of our products and services ."
See also: Hackers target the EU with Konni RAT
The security alert confirms that data was stolen from Entrust's internal systems. However, it is currently unknown whether this was purely corporate data or also customer and supplier data.
Today, Entrust told BleepingComputer that they are working with a leading cybersecurity firm and law enforcement to investigate the attack, but that it has not impacted their operations.
Hit by ransomware gang
While Entrust's security alerts and statements to BleepingComputer did not share further details about the attack, BleepingComputer has learned that a known ransomware gang is behind the attack.
While it is unclear whether the devices were encrypted during the attack, ransomware gangs typically steal data before launching their encryptors for use in double-extortion.
According to AdvIntel CEO Vitali Kremez, a ransomware operation purchased compromised Entrust credentials and used them to compromise their internal network.
See also: Twitter: Hacker sells data of 5.4 million users for $30,000
If Entrust doesn't pay a ransom demand, we'll likely learn which ransomware operation was behind the attack when it publicly releases the stolen data.
Information source: bleepingcomputer.com
