RansomHub ransomware group leaks alleged 487 GB of sensitive data stolen from Kawasaki Motors Europe (KME), following a…

RansomHub ransomware group leaks alleged 487 GB of sensitive data stolen from Kawasaki Motors Europe (KME), following a cyberattack. The breach includes business documents and financial data, raising cybersecurity concerns for global firms.

The notorious RansomHub ransomware group has leaked 487 gigabytes of data it allegedly stole from Kawasaki Motors Europe (KME). This cyberattack was publicly **disclosed** by Kawasaki last week, though the company emphasized that the attack had not been successful in its aims.

As a preventive measure, Kawasaki temporarily isolated its servers and initiated a thorough “cleansing process” to detect any potential infections. However, despite Kawasaki’s recovery efforts, RansomHub went ahead with the data release. On September 5, 2024, the group listed the stolen information on the dark web, utilizing its official dark web leak sites to dump the data.

As seen by the Hackread.com research team, among the exposed files are critical business documents, including financial information, banking records, dealership details, and internal communications.

A partial list of the leaked data includes directories titled “Dealer Lists,” “Financing Kawasaki,” “COVID,” “Trading Terms,” and more, with timestamps showing activity as recent as early September.

Screenshot from the dark web leak site of the RansomHub Ransomware Group (Screenshot credit: Hackread.com)

**Kawasaki’s Response and Cybersecurity Strategy**

While Kawasaki Motors Europe disclosed the breach to its customers, it appears that the company opted not to engage with the ransom demands. **Jason Soroko**, Senior Fellow at Sectigo, speculated that Kawasaki may have prioritized system restoration over paying the ransom.

He suggested that this decision reflects Kawasaki’s readiness to deal with the potential fallout of a data breach, emphasizing the importance of having strong cybersecurity systems in place to avoid financial damage through ransom payments.

_“_Kawasaki Motors Europe’s official statement claimed they could take the hit with the data versus the financial hit of paying the ransom, however, the RansomHub group released 487 GB of allegedly stolen data. This suggests, but does not prove, Kawasaki chose not to negotiate with the attackers, prioritizing system restoration and data cleansing._“_

Soroko added that Kawasaki’s stance might serve as a model for other companies: instead of negotiating with cybercriminals, businesses should focus on recovery and work to fortify their systems against future attacks.

He also pointed out the need for organizations, especially in the United States, to enhance their cybersecurity infrastructure, prepare for such incidents, and collaborate with government authorities to better handle ransomware threats.

_“_Given RansomHub’s increased activity, US companies should bolster cybersecurity measures, prepare robust incident response plans, and avoid paying ransoms, aligning with government advisories. Staying informed about such threats and collaborating with authorities can mitigate risks and protect sensitive data,_“_ he explained.

**The Role of RansomHub**

RansomHub is a notorious player in cybercrime especially ransomware attacks, having made headlines recently for its involvement in other major breaches. Earlier this month, the group claimed responsibility for **hacking Planned Parenthood** and stealing 93 gigabytes of sensitive data.

This trend of increased activity exposes the growing threat posed by ransomware groups, which often target high-profile organizations in sectors ranging from healthcare to manufacturing.

1.  **PythonAnywhere Cloud Platform Abused for Hosting Ransomware**
2.  **Qilin Ransomware Upgrade: Now Steals Google Chrome Credentials**
3.  **Russian Hackers Hit Mail Servers in Europe for Political, Military Intel**
4.  **Xplain Hack: Play Ransomware Leaks Sensitive Swiss Government Data**
5.  **Hackers hit Europe’s largest healthcare provider with Snake ransomware**

RansomHub Ransomware Gang Leaks 487GB of Alleged Kawasaki Europe Data

Flare, the layer-1 blockchain for data, has introduced the Flare Time Series Oracle version 2 (FTSOv2) on its…

Flare, the layer-1 blockchain for data, has introduced the Flare Time Series Oracle version 2 (FTSOv2) on its mainnet. This upgrade builds on the robust foundation of FTSOv1, which has provided consistent, decentralized data feeds since its launch two years ago. FTSOv2 aims to improve the latency, scalability and cost-effectiveness of the original system, which has experienced zero downtime or failures since inception.

FTSOv2 is enshrined into Flare’s core architecture, benefiting from the network’s full economic security. This ensures that every data feed is as secure as the blockchain itself. One of the key enhancements of FTSOv2 is its reduced latency. FTSOv2 updates with every new block on Flare, roughly every 1.8 seconds. This provides developers and users with more immediate and reliable access to data, which is crucial for a range of applications.

FTSOv2 achieves this speed without sacrificing decentralization. Each feed is supported by around 100 independent data providers, selected by users who delegate their stake, imposing a strict economic cost for misbehaviour. Currently, around 67% of the FLR’s circulating supply is used to secure FTSO.

The upgrade also introduces a significant increase in scalability. FTSOv2 can now support up to 1,000 feeds across various asset classes, including cryptocurrencies, equities, and commodities. FTSOv2 achieves this while remaining highly cost-effective, with all crypto feeds being free to query onchain!

****Real-world use case****

Lending and borrowing platforms can benefit from improved speed to ensure more efficient collateral usage and protect users against bad liquidations. In the area of perpetual futures and options, faster Oracle inputs can improve risk management for the entire platform. Cross-chain order books can also benefit from accurate pricing data provided by FTSOv2, ensuring smooth and secure transactions across different blockchain networks.

Moreover, the system can be applied to real-world assets, such as on-chain treasury yields, enabling further integration between traditional finance and blockchain technology.

**Under the hood**

FTSOv2 operates using a manipulation-resistant randomness algorithm to select data providers every 1.8 seconds, allowing them to submit fixed incremental updates to feeds. To ensure the long-term accuracy of the feeds, a commit-reveal process is run across all data providers every 90 seconds. In times of high market volatility, the system can increase the number of data providers submitting updates to ensure timely responses to price fluctuations.

Developers looking to integrate FTSOv2 into their applications can do so with ease, requiring fewer than 10 lines of code to query real-time data, such as FLR/USD prices. Flare offers resources and support through the Flare Developer Hub, as well as a community on Discord for ongoing discussions and assistance.

****About Flare Network****

Flare is the blockchain for data: an EVM smart contract platform specifically designed to support data-intensive use cases, including Machine Learning/AI, RWA tokenization, gaming and social.

With decentralized, enshrined oracles secured at the network layer, Flare is the only smart contract platform optimized for decentralized data acquisition – price & time series data, blockchain event & state data, and web2 API data.

By giving developers trustless access to the broadest range of data and data proofs at scale and for minimal cost, Flare expands the utility of blockchain and supports the development of new and improved use cases.

Flare’s FTSOv2 Launch Sets A New Standard For Decentralized Data

Boston, USA, 16th September 2024, CyberNewsWire

**Boston, USA, September 16th, 2024, CyberNewsWire**

Analysis of millions of real-world NHI secrets by Entro Security Labs reveals widespread, significant risks, emphasizes need for improved Secrets Management security practices   

Entro Security, pioneer of the award-winning Non-Human Identity (NHI) and Secrets Management platform, today released its research report, “2025 State of Non-Human Identities and Secrets in Cybersecurity.” The Entro Security Lab found that 97% of NHIs have excessive privileges increasing unauthorized access and broadening the attack surface, and 92% of organizations are exposing NHIs to third parties, also resulting in unauthorized access if third-party security practices are not aligned with organizational standards. Surprisingly, 44% of tokens are exposed in the wild, being sent or stored over platforms like Teams, Jira tickets, Confluence pages, code commits and more. Such practices put sensitive information at serious risk of being intercepted and exposed–the root of all secrets and non-human identity breaches. 

Entro Security Labs’ research reveals alarming trends in the handling of both human and NHIs, with significant misconfigurations and risks prevalent across organizations. Key findings include: 

*   For each human identity, there are an average of 92 non-human identities. An overwhelming number of non-human identities increases the complexity of identity management and the potential for security vulnerabilities 
*   91% of former employee tokens remain active, leaving organizations vulnerable to potential security breaches 
*   50% of organizations are onboarding new vaults without proper security approval which can introduce vulnerabilities and misconfigurations from the outset 
*   73% of vaults are misconfigured, also leading to unauthorized access and exposure of sensitive data and compromised systems 
*   60% of NHIs are being overused, with the same NHI being utilized by more than one application, increasing the risk of a single point of failure and widespread compromise if exposed 
*   62% of all secrets are duplicated and stored in multiple locations, causing unnecessary redundancy and increasing the risk of accidental exposure 
*   71% of non-human identities are not rotated within the recommended time frames, increasing the risk of compromise over time 

Additional findings are discussed in the report and reveal a critical need for organizations to reassess their NHIs and secrets management practices.  

Data from this report has been collected using a mixed-methods approach, integrating quantitative data analysis with qualitative insights derived from industry observations. The quantitative component focuses on statistical analysis of security incidents and vulnerabilities, while the qualitative aspect provides context and interpretation of these findings within the broader cybersecurity landscape. The data sources include proprietary data from Entro’s cybersecurity infrastructure, secondary data from publicly available industry reports and survey data from IT and security professionals. 

Entro’s complete research report on non-human identities is available on their website. 

To learn more or schedule a demo, please visit https://entro.security/demo/.  

**About Entro Security** 

An award-winning pioneer platform, Entro Security provides Non-Human Identity Lifecycle Management, Secrets Security and Non-Human Identity Detection and Response. Unlike traditional methods that reactively scan for exposed secrets, Entro integrates seamlessly within an organization’s existing vaults, and secret creation and exposure locations, offering a single pane of glass to securely use and manage non-human identities and secrets at scale. Headquartered in Boston and backed by top cybersecurity VCs, Entro was named a Cool Vendor by Gartner, Venafi’s Most Promising Machine Identity startup and is a 2023 Globee Awards Winner for Startup Achievement of the Year. For more information, please visit https://www.entro.security. 

**Contact**

**Senior Account Executive**  
**Hannah Sather**  
**Montner Tech PR**  
**\[email protected\]**

Entro Security Labs Releases Non-Human Identities Research Security Advisory

DeltaPrime DeFi platform suffers a $5.98M hack on the Arbitrum chain due to a private key leak. The attack compromised several liquidity pools, and the team is working on asset recovery and minimizing user losses.

In the early hours of September 16, 2024, DeltaPrime, a prominent decentralized finance (**DeFi**) platform, announced that its Arbitrum-based protocol, DeltaPrime Blue, was exploited in a cyber attack that drained approximately $5.98 million.

According to an official tweet from DeltaPrime at 9:55 AM, the exploit occurred at 6:14 AM CET and was traced to a compromised private key. The team reassured users that the issue is limited to the **Arbitrum chain**, with the Avalanche-based DeltaPrime Red unaffected due to its use of multisig wallets and cold storage for added security.

The company emphasized that they are actively working on asset retrieval and that the platform’s insurance pool is expected to cover losses where possible. Additionally, DeltaPrime is exploring further measures to minimize user losses, pledging ongoing updates through social media and Discord.

> DeltaPrime Blue exploited, this is the current status:
> 
> At 6:14 AM CET DeltaPrime Blue (Arbitrum) was attacked and drained for $5.98M. This was due to a compromised private key, the source of which is currently under investigation.
> 
> DeltaPrime Red (Avalanche) is not vulnerable…
> 
> — DeltaPrime (@DeltaPrimeDefi) September 16, 2024

The attack was first flagged by Cyvers Alerts, a blockchain security platform, which detected suspicious transactions related to DeltaPrime Blue on the Arbitrum chain. In a tweet at 7:36 AM, Cyvers reported multiple suspicious transactions draining liquidity pools, such as DPUSDC, DPARB, and DPBTCb.

They noted that the attacker had already swapped large amounts of USDC for ETH, with the total loss estimated at $4.5 million at the time. An hour later, Cyvers updated their estimate, stating that the losses had increased to $5.93 million, confirming that the attacker had taken control of the private key for DeltaPrime’s admin wallet, allowing them to upgrade proxy contracts and direct them to malicious ones.

> 🚨ALERT🚨@DeltaPrimeDefi has faced a security incident on their admin keys.  
> Attacker had control on the private key of 0x40e4ff9e018462ce71fa34abdfa27b8c5e2b1afb  
> then he upgraded the proxy!
> 
> So far $5.93M has been drained!
> 
> Want to keep your company off our alerts radar? Learn… https://t.co/yOmNZJyp5l pic.twitter.com/lztFvXVmfI
> 
> — 🚨 Cyvers Alerts 🚨 (@CyversAlerts) September 16, 2024

In a comment to Hackread.com, **Meir Dolev,** CTO of CyVers stated _“_The hacker took control of the admin wallet for DeltaPrime’s proxy contracts, later upgrading these contracts to point to his malicious contract, which enabled the draining of the pools on the Arbitrum chain. The total loss is around $5.9 million USD._“_

As the investigation continues, DeltaPrime assures users that their funds on Avalanche remain secure, while they focus on resolving the situation on Arbitrum. Stay tuned, this article will be updated accordingly.

1.  **6 of the Best Crypto Bug Bounty Programs**
2.  **Crypto Scammer Returns $9.27M Out of $24M Crypto Theft**
3.  **Crypto Exchange FixedFloat Hacked: $26M in BTC, ETH Stolen**
4.  **Hackers Stole $59M of Crypto Via Malicious Google and X Ads**
5.  **Crypto losses reach $1.75 Billion in 2023; CeFi and Hacks Blamed**

DeltaPrime Suffers $5.98M Loss as Hacker Exploits Admin Key on Arbitrum

A hacker known as IntelBroker claims to have breached the UK-based company Experience Engine, allegedly exposing sensitive data.…

A hacker known as IntelBroker claims to have breached the UK-based company Experience Engine, allegedly exposing sensitive data. The hacker is selling the data on an online forum, raising concerns about data security for affected clients and businesses.

The notorious IntelBroker hacker has claimed responsibility for breaching Experience Engine, a UK-based company that provides experiential marketing and promotional staffing services. The hacker, who was previously linked to several high-profile data breaches, is now selling the allegedly stolen data on Breach Forums, demanding payment in **Monero** (XML) cryptocurrency to remain anonymous and untraceable.

****Who is Experience Engine?****

Experience Engine, founded over 20 years ago, specializes in creating experiential marketing and promotional staffing solutions. With a global reach and a client base that includes major corporations; they work across sectors such as tech, public sectors, and fast-moving consumer goods (FMCG) brands, offering a network of over 1,200 “Experience Engineers™.”

These professionals are tech-trained to help businesses engage with customers through activations, events, and brand ambassador roles. The company claims to offer access to over 200,000 properties worldwide, focusing on integrating campaigns and humanizing complex technological messages for brands.

Screenshot from Experience Engine’s website highlighting its portfolio

****The Alleged Breach****

According to IntelBroker, the breach occurred in September and involves a trove of sensitive data. The hacker is also offering to sell entire .bak database files, which contain a large amount of client and transactional information. IntelBroker has even provided sample data, which includes details from tables such as dbo.invoice and dbo.booking_backup, containing thousands of rows of sensitive records.

One of the notable tables, dbo.invoice, includes 31,000 rows of data, with fields such as InvoiceID, InvoiceNumber, and InvoiceDate, alongside client-specific information such as contact details and invoice amounts. For instance, one invoice dated October 3, 2006, references Thomas Cook, a now-defunct global travel group, headquartered in the United Kingdom with payment details and banking information related to a booking at the now permanently closed Thirty Thirty New York City Hotel.

InterBorken hacker on Breach Forums (Screenshot: Hackread.com)

Another table, dbo.booking_backup, contains 784,000 rows of data, featuring sensitive customer information such as names, addresses, emails, booking histories, and revenue data. Among the entries are details of clients from the UK, United States, and Saint Lucia, with personal information, email addresses, and booking records all included.

The data sample provided by IntelBroker reveals alarming details of the alleged breach. The exposed data includes highly sensitive information, including financial transactions, customer contact details, and bank account numbers.

For instance, a sample from the dbo.invoice table analyzed by the Hackread.com research team shows details of an invoice amounting to $4699.36, with full banking details for the recipient. The booking records reveal customer names, addresses, and even room revenue from bookings, which can put individuals’ privacy and financial security at risk.

Moreover, the nature of the alleged data breach suggests that Experience Engine’s security protocols may have been insufficient to prevent this large-scale leak. Given that the company manages promotional staffing and experiential campaigns for global brands, the impact on their reputation could be severe.

****IntelBroker’s Dark History****

IntelBroker is no stranger to the hacking world. The hacker has been linked to several high-profile breaches, including the following organisations:

*   **Europol**
*   **Tech in Asia**
*   **Space-Eyes**
*   **Home Depot**
*   **Facebook Marketplace**
*   **U.S. contractor Acuity Inc.**
*   **Staffing giant Robert Half**
*   **Los Angeles International Airport**
*   **Alleged breaches of HSBC and Barclays Bank**

Although the hacker’s origins and affiliates are unknown, according to the United States government, IntelBroker is alleged to be the perpetrator behind one of the **T-Mobile data breaches**.

(Screenshot: Hackread.com)

The alleged breach of Experience Engine adds another company to IntelBroker’s cybercrime portfolio. With millions of sensitive records potentially exposed, the fallout from this breach could have long-lasting consequences.

Hackread.com has reached out to Experience Engine for comment. If and when the company responds the article will be updated accordingly. Stay tuned!

1.  **UK’s Freecycle Data Breach Impacts 7 Million Users**
2.  **Exposed ICS in the US, and UK Threaten Water Supplies**
3.  **NCA Arrests Teenager in Walsall Over TfL Cyber Attack**
4.  **IntelBroker Apple Breach: Steals Source Code for Internal Tools**
5.  **UK Criminal Records Office Down in Potential Ransomware Attack**

Hacker Claims Breach of UK’s Experience Engine, Data Sold Online

A new Android malware called Trojan Ajina.Banker is targeting Central Asia – Discover how this malicious malware disguises…

A new Android malware called Trojan Ajina.Banker is targeting Central Asia – Discover how this malicious malware disguises itself as legitimate apps to steal banking information and intercept 2FA messages. Learn about the tactics used by the attackers and how to protect yourself from this growing threat.

Central Asia has become the target of a malicious new campaign distributing Android malware dubbed “Ajina.Banker.” Discovered by Group-IB in May 2024, Ajina.Banker has been wreaking havoc since November 2023 and around 1,400 unique variants of the malware were identified by researchers.

The malware is named after a malevolent Uzbek mythical spirit known for deception, shape-shifting, and chaos. Ajina.Banker targets unsuspecting users by masquerading as trusted applications like banking services, government portals, and everyday utilities “to maximize infection rates and entice people to download and run the malicious file, thereby compromising their devices.”

The malware primarily spreads through social engineering tactic on messaging platforms like Telegram. Attackers create numerous accounts to distribute malicious links and files disguised as enticing offers, promotions, or even local tax authority apps. Users lured by the promise of “lucrative rewards” or “exclusive access” unknowingly download and install the malware, compromising their devices.

The attackers also employ a multi-pronged approach, sending messages with just the malicious file attached, exploiting user curiosity. Additionally, they share links to channels hosting the malware, bypassing security measures in place on some community chats.

Ajina used themed messages and localized promotion strategies to create a sense of urgency and excitement in regional community chats, urging users to click on links or download files without suspecting malicious intent. These campaigns were conducted across multiple accounts, sometimes simultaneously, indicating a coordinated effort.

While primarily targeting users in Uzbekistan, Ajina.Banker’s reach extends beyond borders. The malware collects information on installed financial applications from various countries, including Armenia, Azerbaijan, Iceland, and Russia. Additionally, it gathers SIM card details and intercepts incoming SMS messages, potentially capturing 2FA codes for financial accounts.

The malware exhibits a concerning level of adaptability. The analysis reveals two distinct versions – com.example.smshandler and org.zzzz.aaa – suggesting ongoing development. Newer versions showcase additional functionalities, including the ability to steal user-provided phone numbers, bank card details, and PIN codes.

Group-IB’s investigation suggests Ajina.Banker operates on an affiliate program model. A core group manages the infrastructure, while a network of affiliates handles distribution and infection chains, likely incentivized by a share of the stolen funds.

To protect yourself and your devices from Ajina.Banker and similar threats, be cautious of unsolicited messages and downloads, stick to trusted app stores like Google Play Store, scrutinize app permissions, install security software, and stay updated on the latest malware threats and best practices for mobile security.

Rocky Cole, Co-Founder and COO of mobile device security company iVerify shared his comments about this cunning new campaign with Hackread.com:

“Credential theft is the number one action being taken by threat actors. It’s so easy to steal credentials on phones where smaller screens, lower attention spans, lack of training, and the mixing of personal and professional use cases put people at risk. This new Android malware is just a continuation of that trend and a prime example of why phones should be running EDR platforms to detect malicious APKs and social engineering attempts.”

1.  **Hackers using Google Sites to spread banking malware**
2.  **Google reveals spyware attack on Android, iOS, and Chrome**
3.  **Scylla Ad Fraud on iOS, Android Users Halted by Apple, Google**
4.  **V3B Phishing Kit Steals Logins and OTPs from EU Banking Users**
5.  **Android Banking Malware FjordPhantom Steals Via Virtualization**

New Android Malware Ajina.Banker Steals 2FA Codes, Spreads via Telegram

Singapore, Singapore, 13th September 2024, CyberNewsWire

**Singapore, Singapore, September 13th, 2024, CyberNewsWire**

SquareX has been named a winner of the prestigious Rising Star category in **CybersecAsia Readers’ Choice Awards 2024** **Awards****,** due to its outstanding achievements in its innovative browser security solutions.

For the past 5 years, this award has been honouring cybersecurity organizations that are making a significant impact and delivering ground breaking solutions to help enterprises in the region to defend against cyberthreats.

Held at Network Hub @ Guoco Midtown, this highly sought after event was attended by more than 70 cybersecurity industry veterans, regional CISOs and cybersecurity practitioners who witnessed and recognized winners across more than 20 award categories. 

> “Ever since web browsers became the de facto interface for the Internet, they have also provided the biggest attack surface for bad actors,” said Victor Ng, Editor-in-Chief of CybersecAsia. “As Asia Pacific becomes a more connected and digital economy, the cyber risks posed by browsers have loomed larger. That’s why we need real-time browser-native detection and response solutions, and SquareX – launched in 2023 out of Singapore – is a Rising Star providing such solutions to mitigate the risks from web-based threats.”

> “SquareX is honoured to be recognized as a Rising Star winner in CybersecAsia Readers’ Choice 2024 Awards because it demonstrates the crucial role and impact that browser security is bringing to the cybersecurity landscape,” said Vivek Ramachandran, Founder & CEO of SquareX.

Vivek Ramachandran continued to emphasize the critical need for effective enterprise browser security:

> “The browser is the most used tool by enterprises but also the least protected – making it a gateway to most attacks. Enterprises need robust solutions to protect themselves from web attacks happening to enterprise users in real-time. Our browser security detection and response solution is able to detect and mitigate web threats as they happen, ensuring that enterprises are protected at all times.” added Vivek Ramachandran.

SquareX is privileged to receive this accolade from CybersecAsia as it validates the company’s exceptional performance in mitigating web-based threats, and solidifies its leadership position in the browser security space. The team remains committed to safeguarding enterprises and their employees.

**About SquareX:**

SquareX helps organizations detect, mitigate and threat-hunt client-side web attacks happening against their users in real time.

SquareX’s industry-first Browser Detection and Response (BDR) solution, takes an attack-focused approach to browser security, ensuring enterprise users are protected against advanced threats like malicious QR Codes, Browser-in-the-Browser phishing, macro-based malware and other web attacks encompassing malicious files, websites, scripts, and compromised networks.

With SquareX, enterprises can provide contractors and remote workers with secure access to internal applications, enterprise SaaS, and convert the browsers on BYOD / unmanaged devices into trusted browsing sessions.

For more information, readers can visit http://www.sqrx.com

**Contact**

**Head of PR**  
**Junice Liew**  
**SquareX**  
**\[email protected\]**

SquareX, Awarded Rising Star Category in CybersecAsia Readers’ Choice Awards 2024

A hacker claims to have stolen 440 GB of data from cybersecurity firm Fortinet, exploiting an Azure SharePoint…

A hacker claims to have stolen 440 GB of data from cybersecurity firm Fortinet, exploiting an Azure SharePoint vulnerability. The breach, dubbed “Fortileak,” was revealed on a forum with access credentials shared online.

A hacker using the alias “Fortibitch” has claimed responsibility for leaking 440 GB of data belonging to Fortinet, a prominent cybersecurity firm based in Sunnyvale, California. The hacker stated that the stolen data is now accessible for download via an Amazon S3 bucket, with details of the breach and access credentials shared on the popular underground forum, Breach Forum.

**The Breach: Fortileak**

Dubbed _Fortileak_ by the hacker, the breach allegedly originates from an exposure in Fortinet’s Azure SharePoint instance. In the forum post, the hacker pointed out recent acquisitions by Fortinet, including the Data Loss Prevention (DLP) firm Next DLP and the cloud security company Lacework. They then claimed that Fortinet’s Azure SharePoint had been compromised, allowing for the extraction of the substantial data cache.

The full scope of the compromised data remains unclear, though the hacker emphasized that the breach involves Fortinet’s cloud infrastructure. The hacker provided the following credentials for accessing the alleged stolen data:

Screenshot: Hackread.com

**Ransom Demands and Negotiation Breakdown**

In a further twist, the hacker claimed that Fortinet’s CEO, Ken Xie, walked away from ransom negotiations. In the forum post, the hacker ridiculed Xie, alleging that the CEO refused to engage, stating that he “would rather eat some p\*\*p than pay ransom.” The hacker also questioned why Fortinet had not filed an SEC 8-K form (PDF)—a document required by public companies to disclose major incidents.

The post also contained a mix of taunts and shout-outs to other individuals or groups, which seemed to further underline the hacker’s brash attitude toward the attack and its aftermath.

**Fortinet’s Response**

Hackread.com reached out to Fortinet for an official comment on the breach. A spokesperson for the company confirmed that an unauthorized individual had gained access to a limited number of files stored on a third-party cloud-based shared file drive. These files included data related to a “small” subset of Fortinet customers.

In their statement to Hackread.com, Fortinet reassured stakeholders that there has been no indication of any malicious activity affecting its customers. They emphasized that the company’s operations, products, and services have not been impacted by the breach. Fortinet stated that they have already communicated directly with the affected customers and are continuing to monitor the situation closely.

> _“An individual gained unauthorized access to a limited number of files stored on Fortinet’s instance of a third-party cloud-based shared file drive, which included limited data related to a small number of Fortinet customers, and we have communicated directly with customers as appropriate. To-date there is no indication that this incident has resulted in malicious activity affecting any customers. Fortinet’s operations, products, and services have not been impacted.”_
> 
> Fortinet Spokesperson

This is not the first time Fortinet has faced a cybersecurity incident. Last year, Chinese hackers were reported to be exploiting a zero-day vulnerability in the company’s products. In another instance, hackers were found exploiting a vulnerability in FortiOS, the operating system for Fortinet’s security appliances, to compromise organizations and customers.

Nevertheless, for now, the full extent of the breach remains under investigation, and it is unclear whether the alleged stolen data will be used maliciously or if the ransom negotiations will have any further developments. As more information emerges, both customers and cybersecurity professionals will be watching closely to assess the impact of this incident.

1.  **World’s Leading Cybersecurity Firm Kaspersky Hacked**
2.  **CISA and Fortinet Warns of New FortiOS Zero-Day Flaws**
3.  **X Account of Google Cybersecurity Firm Mandiant Hacked**
4.  **Cybersecurity Firm Hacks Itself, Finds AWS Credentials Leak**
5.  **Hackers dump plain-text login credentials of Fortinet VPN users**

Fortinet Confirms Limited Data Breach After Hacker Leaks 440 GB of Data

A recent National Crime Agency (NCA) investigation led to the arrest of a teenager in Walsall, England, linked…

A recent National Crime Agency (NCA) investigation led to the arrest of a teenager in Walsall, England, linked to a cyberattack on Transport for London (TfL). While the attack caused some disruptions, core services were largely unaffected.

National Crime Agency (NCA) has apprehended a teenager in Walsall, England, in connection with a cyber security incident that impacted Transport for London (TfL). The arrest is part of an ongoing investigation into the attack, that caused some disruptions, though the impact on core public transport services was minimal.

> Transport for London (@TfL) is addressing an ongoing cybersecurity incident. No customer data has been compromised, and services are unaffected. They're working with government agencies and will provide updates. Stay informed via the TfL website. #CyberSecurity #London pic.twitter.com/ozUDOs18uw
> 
> — Hackread.com (@HackRead) September 2, 2024

The teenager, whose identity has not been released due to their age, was arrested by NCA officers in Walsall. The arrest follows 2 weeks of investigation into the cyber attack. Charges have not yet been formally filed, but it is anticipated that they will be related to the incident.

The arrest and the age of the alleged hacker align with the **NCA’s February 2024 findings**, which revealed that 1 in 5 youths in the United Kingdom engage in cybercrime. The agency disclosed that one in five children aged 10-16 in the UK have participated in online activities that violate the Computer Misuse Act.

Jake Moore, Global Cybersecurity Advisor at ESET, provided insights into the potential motivations behind the attack and the importance of educating young people about the consequences of cybercrime.

Moore suggested that if a single individual was responsible for the TfL attack, it might have been a “cyber trial” rather than an organized attack. He explained that many young people experiment with their hacking skills without fully understanding the potential consequences of their actions.

“Hopefully, this can be a lesson to all those with similar skills to make sure they use them legally and for good,” Moore said. “When personal and financial details such as bank account numbers and sort codes are compromised, it no longer becomes a game of who can go the furthest and instantly becomes serious.”

> A teenager has been arrested by the NCA, as part of the investigation into a cyber security incident affecting Transport for London (TfL).
> 
> FULL STORY ➡️ https://t.co/TFbZdJ3FDO
> 
> — National Crime Agency (NCA) (@NCA\_UK) September 12, 2024

The involvement of teenagers in cybercrime is quite a serious issue. Unlike older individuals, who may be motivated by financial gain or organized crime, teens often view these activities as a game, without fully understanding the legal and ethical consequences.

Moreover, early involvement in cybercrime could set them on a dangerous path, limiting their potential for positive career opportunities while contributing to an increase in sophisticated online threats. As cyber criminals get younger, the challenges for law enforcement and cybersecurity professionals grow more difficult, demanding targeted interventions to prevent a generation from falling into cybercrime.

Nevertheless, as the investigation into the TfL cyber attack is underway, it is expected that more information will emerge regarding the teenager’s involvement and the extent of the damage caused.

1.  Aussie Arrested for “Evil Twin” Wi-Fi Scam Targeting Travelers
2.  MIT Graduate Brothers Arrested for $25 Million Ethereum Heist
3.  4 Arrested as Operation Endgame Disrupts Ransomware Botnets
4.  23-Year-Old Arrested for Running 100M Incognito Dark Web Market
5.  Teen among suspects arrested in Android banking malware scheme

NCA Arrests Teenager in Walsall Over TfL Cyber Attack

Silver Spring, United States, 12th September 2024, CyberNewsWire

**Silver Spring, United States, September 12th, 2024, CyberNewsWire**

The investment will drive the company’s advancement of scalable workload access management for enterprises

Aembit, the leading non-human identity and access management (IAM) company, has secured $25 million in Series A funding, bringing its total capital raised to nearly $45 million. Acrew Capital led the round, with participation from existing investors Ballistic Ventures, Ten Eleven Ventures, Okta Ventures, and CrowdStrike Falcon Fund.

Aembit’s funding comes in the wake of continued high-profile non-human identity attacks on organizations such as Cloudflare, The New York Times, and Microsoft. Non-human identity (NHI) refers to the applications, scripts, and bots that businesses use to automate their operations, as well as the credentials used by NHIs to communicate to sensitive databases, applications, and infrastructure. 

These incidents exposed secrets such as API keys, access tokens, and other non-human access credentials, which were used to penetrate enterprise environments. In a newly published survey of security professionals, Aembit found that most organizations still struggle with managing NHI credentials securely: Over 30% still storing credentials in code, and 23% using email and chat to share credentials. Over 60% of respondents are looking for a comprehensive solution across their entire organization.

Security professionals are recognizing the need for an access-focused approach that automates identity-driven, secretless, centrally enforced, and auditable access between distributed applications and SaaS services to sensitive resources in the cloud and on-premises. 

Aembit has led the market in solving this emerging challenge by pioneering non-human IAM. It enables policy-based access management between workloads and the sensitive resources they access, moving beyond reactive visibility and governance to proactively shrink the attack surface of rapidly growing and highly distributed non-human identities. Aembit was recently lauded as a Top 2 finalist in the prestigious 2024 RSA Innovation Sandbox competition and is a finalist for Best Identity Management Solution at the 2024 SC Awards. Aembit continues to advance access management with capabilities such as MFA-strength conditional access, policy automation via infrastructure-as-code, and robust auditing for NHI access. 

> “Aembit is tackling one of the most pressing challenges in modern enterprise security,” said Mark Kraynak, founding partner at Acrew Capital. “The shift to cloud and SaaS, and AI has driven an order-of-magnitude expansion in non-human identities. With the proliferation of microservices and APIs across diverse environments, IAM has become the critical first line of defense for protecting sensitive data. Legacy access management approaches weren’t designed with this level of scale and automation in mind. We are thrilled to be partnering with Aembit to bring a new approach to the market.”

Co-Founders David Goldschlag and Kevin Sapp have spent their careers innovating across the identity landscape, most recently creating New Edge Labs (acquired by Netskope), one of the first user zero trust products on the market.

> “Kevin and I founded Aembit with a vision to help enterprises secure access between non-human workloads, applications, and software resources with the same principles used today to secure human access,” said David Goldschlag, co-founder and CEO of Aembit. “Talking to hundreds of enterprises, and working closely with design partners, our approach centers on proactively securing access between non-human identities, while eliminating friction for developers and security teams.”

> “By solving non-human IAM, Aembit is tackling an essential security challenge,” said Brad Jones, CISO at Snowflake and an Aembit customer. “Not only is their approach to non-human access innovative, but Aembit is a provider we can rely on.”

The Aembit Workload IAM Platform enforces secure access between non-human workloads and the services that authorize access to sensitive data and infrastructure. Aembit’s policy engine grants secretless access, just-in-time, based on the workload’s identity and posture. 

Leveraging native identities and sophisticated automation, organizations use Aembit to eliminate storage of sensitive secrets within applications or vaults by moving to short-lived access tokens with a no-code auth approach. With Aembit, businesses proactively secure non-human access while eliminating the manual and fragmented work required today by security, engineering, and DevSecOps teams.

**About Aembit**

Aembit is the non-human identity and access management platform that secures access between workloads across clouds, SaaS, and data centers. With Aembit’s identity control plane, DevSecOps can fully automate secretless, policy-based, and Zero Trust workload access with MFA-strength capabilities. For more information, users can visit https://aembit.io/ and follow us on LinkedIn.

**Contact**

**CMO**  
**Apurva Davé**  
**Aembit**  
**\[email protected\]**