06/09/2021

Ransomware Struck Another Pipeline Firm

The leak compromised 70GB of data

When ransomware hackers hit Colonial Pipeline last month and shut off the distribution of gas along much of the East Coast of the United States, the world woke up to the danger of digital disruption of the petrochemical pipeline industry. Now it appears another pipeline-focused business was also hit by a ransomware crew around the same time, but kept its breach quiet—even as 70 gigabytes of its internal files were stolen and dumped onto the dark web.

A group identifying itself as Xing Team last month posted to its dark web site a collection of files stolen from LineStar Integrity Services, a Houston-based company that sells auditing, compliance, maintenance and technology services to pipeline customers. The data, first spotted online by the WikiLeaks-style transparency group Distributed Denial of Secrets, or DDoSecrets, includes 73,500 emails, accounting files, contracts, and other business documents, around 19 GB of software code and data and 10 GB of human resources files that includes scans of employee driver's licenses and Social Security cards. And while the breach doesn't appear to have caused any disruption to infrastructure like the Colonial Pipeline incident, security researchers warn the spilled data could provide hackers a roadmap to more pipeline targeting.

DDoSecrets, which makes a practice of trawling data leaked by ransomware groups as part of its mission to expose data it deems worthy of public scrutiny, published 37 gigabytes of the company's data to its leak site on Monday. The group says it was careful to redact potentially sensitive software data and code—which DDoSecrets says could enable follow-on hackers to find or exploit vulnerabilities in pipeline software—as well as the leaked human resources material, in an effort to leave out LineStar employees' sensitive, personally identifiable information.

Please select this link to read the complete article from WIRED.