SpaceBears' Ransomware Hits Haylem Technologies

Incident Date: Jul 05, 2024

Attack Overview
VICTIM
Haylem Inc.
INDUSTRY
Education
LOCATION
Canada
ATTACKER
SpaceBears
FIRST REPORTED
July 5, 2024

Ransomware Attack on Haylem Technologies Inc. by SpaceBears Group

Company Profile: Haylem Technologies Inc.

Haylem Technologies Inc., based in Terrebonne, Quebec, is a distinguished engineering and technology company that has been operational since 2008. Specializing in developing software solutions for individuals with reading and writing difficulties, Haylem stands out in the education sector for its innovative approach to assistive technology. Their flagship product, Lexibar, helps users with dyslexia and dysorthographia by correcting common spelling errors through a phonetic predictor. The company's influence extends across 87% of educational institutions in Quebec, showcasing its significant impact and adoption. Haylem's commitment to enhancing literacy and communication for people with learning disabilities is further demonstrated through their multidisciplinary services, including speech and occupational therapies.

Details of the Ransomware Attack

Haylem Technologies Inc. has recently fallen victim to a ransomware attack orchestrated by the notorious group known as SpaceBears. The cybercriminals have encrypted valuable data and are threatening to release sensitive information, including financial documents, databases, and personal details of employees and clients unless a ransom is paid. The deadline set by the attackers is looming, with a release scheduled within the next 5-6 days unless their demands are met.

Profile of the SpaceBears Ransomware Group

The SpaceBears group is known for its aggressive ransomware campaigns that target a variety of sectors worldwide. This group encrypts the victim's data and subsequently demands a ransom for decryption keys. Notoriously, they have no available decryptor, making their attacks particularly damaging. SpaceBears distinguishes itself through the use of a dark web leak site, where they threaten to publish stolen data, engaging in double extortion tactics. Their operations have impacted organizations in healthcare, agriculture, and more, across multiple continents including North America, Europe, and Asia.

Potential Vulnerabilities and Attack Vectors

While specific details of the breach vector in Haylem's case remain unclear, common entry points for such attacks include phishing emails, compromised credentials, and unpatched software vulnerabilities. Given Haylem's extensive digital footprint and reliance on technology for delivering educational and therapeutic services, it is plausible that their systems could have been compromised through one of these methods. The integration of various services following their acquisition of the clinic "Un Museau vaut mille Mots" might have also expanded their attack surface, potentially introducing new vulnerabilities in their network.

Sources

See Halcyon in action

Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!

1
2
3
Let's get started
1
1
2
3
1
1
2
2
3
Back
Next
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.