Ransomware Hits Bogdan & Frasco, LLP: Data Compromised by Cicada3301
Ransomware Attack on Bogdan & Frasco, LLP by Cicada3301
Bogdan & Frasco, LLP, a well-regarded accounting and tax services firm based in San Francisco, has recently fallen victim to a ransomware attack orchestrated by the cybercriminal group known as Cicada3301. The attack, disclosed on August 31, 2024, has compromised approximately 200 units of sensitive data, raising significant concerns about data security and client confidentiality.
About Bogdan & Frasco, LLP
Founded in 1995, Bogdan & Frasco, LLP operates from the heart of San Francisco's financial district, directly above the Montgomery Street BART station. The firm specializes in providing comprehensive accounting and tax services to small and medium-sized businesses as well as individual clients. Their services include tax preparation, estate and trust tax preparation, international taxation, and specialized expertise in equity compensation, making them particularly valuable to clients in the tech industry.
Despite its modest size, with approximately 7 employees and an annual revenue of around $3 million, the firm has built a strong reputation for personalized service, keen expertise, and responsiveness to client inquiries. This high level of service and specialization in complex tax situations, such as those involving stock options, sets them apart in the industry.
Attack Overview
The ransomware attack by Cicada3301 has significantly impacted Bogdan & Frasco, LLP. The cybercriminal group, known for its data broker operations, exfiltrated sensitive information and published samples on their dark web leak site. This tactic pressures the firm to comply with their demands while also monetizing the stolen data through sales on dark web marketplaces.
About Cicada3301
Cicada3301 emerged in June 2024 and quickly gained notoriety for its unique approach to cybercrime. Unlike traditional ransomware groups that focus on encrypting data and demanding ransom for decryption, Cicada3301 specializes in stealing and selling sensitive data. This shift in tactics reflects a broader trend in the cyber threat landscape, where data exfiltration and long-term exploitation are becoming more prevalent.
The group operates a leak site to publish stolen data, serving as both a warning to potential victims and a marketing tool to attract buyers. Their operations can cause long-term damage to organizations, including identity theft, corporate espionage, and reputational harm.
Potential Vulnerabilities
While the specific method of penetration used by Cicada3301 in this attack is not publicly disclosed, common vulnerabilities that could have been exploited include weak passwords, outdated software, and insufficient network security measures. Given the firm's focus on handling sensitive financial data, robust cybersecurity protocols are essential to protect against such sophisticated threats.
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!