France Tries to Recover After Massive Cyber-Attack

What Exactly Happened?

The raw facts of the case are these. Viamedis and Almerys were attacked by unknown cybercriminals earlier this month, with the attackers managing to steal a staggering amount of confidential data. The number of those affected directly is presumed to be over 33 million.

The leaked data includes:

• The clients’ marital status
• Their date of birth
• The social security number and the
• Name of the health insurer

According to CNIL (Commission Nationale Informatique et Libertes), no contact details have been leaked. Despite that, the experts still warn that the danger may not end. The attackers may corroborate the leaked data with that of previous attacks.

This may allow them to eventually obtain contact details and more sensitive information that they could use to conduct future operations.

How It Happened?

The exact tactics involved in the hits are unknown, but initial investigations hint at the cybercriminals using stolen credentials to access the victims’ systems. This is somewhat atypical, as phishing attacks are generally the standard in DDoS attacks and ransomware breaches because they’re pretty successful and give the attackers easy access to the victim’s systems.

Investigations are ongoing, with experts trying to determine how the attackers operated. This will provide valuable insight into their MO and allow potential victims to improve their defenses based on that.

Who Was Affected?

According to the initial estimates, the total number of victims climbs a little over 33 million, an unprecedented amount of leaked data. However, experts warn that this may not be the end of it.

With time, even more victims may emerge, many of whom may not even be involved in the initial attacks. That’s because cybercriminal organizations are very good at extrapolating from the original stolen data to find more sensitive information about the victims.

The Attackers’ Motivations

The details regarding the two breaches are unclear, but it appears that the attackers were strictly interested in the stolen data. This suggests that it was a deliberate and targeted attack and that the attackers were financially motivated.

It’s not uncommon for cybercriminals to profit from stolen information, even without asking for a ransom. Instead, they might sell the information to one or more ransomware actors, who will contact the victims to extort them.

So far, no attempts have been reported to extort or blackmail the two corporations affected or any of their clients. But, as experts warn, this can always change.

The Ongoing Investigation

As evidence suggests, the anonymous attackers used stolen credentials to infiltrate the victim’s systems and exploit their vulnerabilities. This unusual MO may hint at potential moles inside the targeted companies that worked with the attackers.

Following the confirmation of the attacks, the French data authority warned about the rising number of phishing and ransomware attacks. According to experts, it’s not only the high-value targets at risk but also medium and small business entities.

Ransomware attacks are hazardous because they allow cybercriminals to extort the victims in exchange for stolen data. This hasn’t been the case yet in the French cyberattacks, but things can always change for the worse.