1 in 7 Ransomware Extortion Leaks Include Sensitive Operational Technology Details

New analysis of published data from ransomware attacks puts the spotlight on the potential that some of your most critical data stolen puts you materially at risk of another attack.

Anyone feel like publishing their usernames and passwords, IP addresses, remote service details, asset tags, original equipment manufacturer (OEM) information, or network diagrams? No one in their right mind would put any of this information out for public consumption.

But, according to the security analysts at Mandiant Intelligence, 1 out of every 7 ransomware attacks that include the theft of sensitive data as part of an extortion scheme that gets published includes much of the data I just mentioned. We’ve recently seen a massive jump of 953% (not a typo!) in ransomware attacks that publish victim data, which only helps make this including of sensitive operational technology information more dangerous to victim organizations.

This is truly concerning.

The information above can easily be used by hackers intent on infiltrating your network and moving laterally within it. The data types I mentioned above were found by Mandiant when they searched through published data in 2021.

This news makes it clear that organization cannot afford a ransomware attack and the assumed aftermath of exfiltrated data – something that occurs in 83% of all ransomware attacks. Phishing still remains a primary initial attack vector, putting Security Awareness Training at the top of the list for security initiatives that empower users to play a role in stopping attacks that make it past security solutions all the way to the Inbox.