Liberty Resources Hit by Rhysida Ransomware: Sensitive Data Compromised
Liberty Resources Targeted by Rhysida Ransomware Group
Liberty Resources, a not-for-profit organization based in Syracuse, New York, has fallen victim to a ransomware attack orchestrated by the Rhysida Ransomware Group. The organization, which focuses on promoting independent living for individuals with disabilities, has had sensitive data exfiltrated, including passports and Social Security Numbers (SSNs).
About Liberty Resources
Liberty Resources operates as a Center for Independent Living (CIL) and is dedicated to advocating for the civil rights and equal access of persons with disabilities. Established in 1994, the organization employs over 900 professional staff members and serves nearly 11,000 individuals and families annually. The organization provides a range of services, including behavioral health, physical health, and disability services, aimed at fostering independence and well-being.
Attack Overview
The Rhysida Ransomware Group claims to have breached Liberty Resources' systems, exfiltrating sensitive data and causing disruptions to their phone system. The attackers have demanded a ransom of 20 Bitcoin (approximately $1,175,000) with a deadline set for August 22. The breach has raised significant concerns about the security measures in place at Liberty Resources, particularly given the sensitive nature of the data they handle.
About Rhysida Ransomware Group
The Rhysida Ransomware Group emerged in May 2023 and has quickly become notorious for targeting sectors such as healthcare, education, and government. The group employs a double extortion technique, stealing data before encrypting it and threatening to publish it unless a ransom is paid. Rhysida ransomware is written in C++ and uses the ChaCha20 encryption algorithm. The group typically deploys the ransomware through phishing campaigns and leverages valid credentials to establish network connections.
Penetration and Vulnerabilities
Rhysida likely penetrated Liberty Resources' systems through phishing campaigns or by leveraging valid credentials. The organization's extensive handling of sensitive data, combined with potential vulnerabilities in their cybersecurity infrastructure, made them an attractive target for the ransomware group. The attack underscores the importance of effective cybersecurity measures, particularly for organizations handling sensitive personal information.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!