Retailer Fined After Ransomware Attack Affects Nearly One Million

Major Data Breach Leads To Financial Penalty

An electronics and furniture retailer has been ordered to pay a fine of $178,000 following a significant security failure that exposed the personal information of 946,972 individuals. The incident, which occurred in September 2022, involved a ransomware attack that targeted the company’s network, impacting 941,513 customers and 5,459 current, former, and prospective employees. This event marks the third time the company has breached data protection obligations since January 2019.

The breach involved a wide array of sensitive information. For employees, the compromised data included bank account details and information regarding their creditworthiness. Customer data exposed during the attack included names, identification numbers, residential addresses, and phone numbers. In some instances, the last four digits of credit card numbers were also accessed.

Technical Failures And Attack Vector

Investigations revealed that the attacker gained entry to the network around September 21, 2022. The point of entry was through servers designed for disaster recovery, which were intended to keep business operations running if main systems failed. Two of these recovery servers were accessible via the internet, providing a vulnerable entry point. The attacker scanned for network weaknesses and eventually obtained a system administrator’s login credentials through unknown methods.

Once inside the disaster recovery servers, the attacker used existing connections to reach other parts of the corporate network. Ransomware was subsequently installed on 26 servers, with 20 of those servers experiencing full or partial data encryption. The company detected the malware around September 26, and by October 1, a customer service employee received a ransom demand for a password to recover the encrypted files. The company chose not to respond to the demand, and no further contact from the attacker was reported.

To mitigate the damage, the retailer isolated the affected servers, restored systems using clean backups, installed necessary security updates, and tightened access controls. Monitoring of the internet and the dark web for 12 months following the event found no evidence that the affected data had been publicly disclosed or extracted from the systems.

Regulatory Findings And Systemic Failures

Regulatory authorities determined that the company failed to conduct essential security checks that could have identified the weaknesses exploited in the attack. Specifically, the retailer had excluded its recovery servers from regular vulnerability scans. The company argued that these servers were not critical because they were not used for daily business operations; however, regulators rejected this reasoning, noting that these servers provided a gateway to other systems containing vast amounts of personal data.

Furthermore, the company failed to implement timely security updates. The two internet-facing recovery servers had not been patched since July 6, 2022. Additionally, several other servers were running outdated operating systems, including Windows Server 2008, which had ceased to be supported by Microsoft in January 2020.

In deciding the $178,000 fine, authorities considered the massive scale of the incident and the sensitivity of the financial information belonging to employees. A significant factor in the penalty amount was the company’s history of repeated failures. In 2019, the retailer was fined $15,000 after a website flaw exposed customer phone numbers and addresses. In 2020, it was fined $9,000 after a faulty email link allowed unauthorized access to member accounts.

Regulators emphasized that the systemic failure to implement basic cybersecurity policies, such as patch management and security reviews, despite previous penalties, necessitated a higher fine to serve as an effective deterrent. The company has since accepted the decision and apologized to the affected parties. It stated that it has strengthened security measures, engaged cybersecurity specialists, and appointed an external vendor to review the affected data. While employees were notified due to the sensitivity of their financial data, customers were not notified, as the company assessed that their information was unlikely to cause significant harm.