[Contained][Severity: Moderate][Ransomware]

NITTAN: its servers were accessed without authorization, apparently by ransomware, and it cut the network and expects recovery to take time

It was infected with ransomware on September 13 through weak password management of its VPN device. No leak of information is confirmed.

Disclosed

2022-09-13

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2022-09-13
In the early morning it confirmed unauthorized access to its servers, apparently ransomware, and immediately cut the network. It reported to the police and the system vendor, and is identifying the affected servers and files, investigating the cause and recovering. Recovery is expected to take time. [1]
2022-09-30
It published a second report. There is no major effect on production or delivery, no leak has been confirmed, and a specialist forensic firm has joined the investigation. [2]
2022-10-31
A third report gave the investigation results. The cause was weak password management of the VPN device, and the LockBit 2.0 ransomware had been run. No leak has been confirmed. [3]

Cause and measures

The VPN device was updated for a vulnerability that came out last year, but the passwords had already leaked before the update. The password of an old account that had not been changed was abused. The internal systems lacked protection tools and vulnerability management and could not prevent the execution and encryption by LockBit 2.0. Interim measures are complete and the network of the stopped systems is expected to be restored soon. A specialist firm and an internet search found no leak of personal or customer information. [3]