Vodka Maker Bankrupt After Cyberattack

Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week, Vodka maker bankrupt after cyberattack, the Trinity ransomware group didn’t actually hack the Spanish tax agency, and one of the recent cable cuttings in Finland was actually a mistake – but the other might still be sabotage. Hackers stole data from Japanese online shoppers, U.S. government contractor Chemonics International has a data brach as did law firm Keesal, Young & Logan. Operation HAECHI-V, an Asian cybercrime sweep, netted thousands of suspects and the seize of $400 million. Cyberattacks are surging in the United Kingom and U.S. energy contractor ENGlobal underwent a ransomware attack.

See Also: Gartner Guide for Digital Forensics and Incident Response

Vodka maker Stoli Group’s U.S. subsidiaries, Stoli USA and Kentucky Owl, filed for bankruptcy Nov. 27, citing an August ransomware attack and ongoing disputes with the Russian government as causes for its voluntary petition for protection against creditors.

Stoli USA CEO Chris Caldwell said in a decleration that the August ransomware attack knocked out the company’s enterprise planning system and forced its accounting system into manual entry mode – a state of affairs that won’t be fixed until the first months of 2025.

The incident also prevented the companies from providing financial reports to lenders, leading to claims of default on $78 million in debt. Meanwhile, Russian authorities confiscated two distilleries valued at $100 million after labeling Stoli Group

Caldwell also pointed to fights with the Kremlin, which has attempted since 2000 to reclaim the “Stolichnaya” trademark after the post-Soviet Russian government privatized it during the 1990s. A Russian court in July declared Stoli founder Yuri Shefler and the firm’s two main holding companies to be “extremists” for their support of Ukraine, which Russia is attempting to conquer. The government confiscated its last two distilleries located inside Russia. The distilleries were valued at approximately $100 million.

Shefler, a vocal critic of the Russian autocrat Vladimir Putin, fled Russia in 2002 and has since gained British citizenship.

Ransomware group Trinity claimed it filched 560 gigabytes of data from the Spanish Tax Administration Agency, known as AEAT for its Spanish acronym. The agency said Wednesday that it’s likely a case of mistaken identity: Hackers appear to have actually attacked a private firm that deals with tax and labor matters. Trinity apparently assumed the records it stole meant it successfully penetrated AEAT.

In an emailed statement, an agency spokesperson said an investigation sparked by the Dec. 1 claim by Trinity on its dark web leak site has shown that “there exists no evidence at all that [AEAT] systems or data under its control have been affected.” Trinity “has not contacted the tax agency at any point with a ransom demand and nor has it shown its supposed possession of taxpayer data,” the spokesperson said.

This wouldn’t be the first time a ransomware hacker – whose first language typically is Russian – would have become confused about its actual victim. Ransomware as a service operation LockBit in June claimed to have breached the U.S. Federal Reserve Bank. It actually attacked Evolve Bank & Trust, which is part of West Memphis, Arkansas-based Evolve Bancorp. LockBit affiliates may have jumped to conclusions after seeing a stolen document that said “United States Federal Reserve” (see: Bogus: LockBit’s Claimed Federal Reserve Ransomware Hit).

Finnish police said Tuesday that the breakage of a fiber optic cable connecting it to Sweden was not sabotage. Police believe the damage was caused by excavation work, reported Finnish newspaper YLE News. The disruption affected more than 100 businesses and 6,000 consumers.

Finnish communications regulator Traficom investigated the damage, which occurred in two locations in southern Finland, Vihti and Leppävaara. Local police confirmed there was no criminal activity.

This incident follows a more severe cable cut in November, when the undersea C-Lion1 fiber-optic cable between Finland and Germany and submerged cables between Lithuania and Sweden were severed. Those incidents are being investigated as intentional sabotage, with a Chinese bulk carrier that left the Russian Baltic port of Ust-Luga on Nov. 15 suspected of severing the cables. “It’s extremely unlikely that the captain would not have noticed that his ship dropped and dragged its anchor, losing speed for hours and cutting cables on the way,” a senior European investigator involved in the case told the Wall Street Journal.

Hackers stole personal information of at least 100,000 Japanese online shoppers from 11 e-commerce websites in Tokyo, including Tully’s Coffee Japan and JF Zengyoren, reported Japanese media. Hackers exploited vulnerabilities by inserting malicious code into order forms, enabling remote tampering.

The breaches, undetected for years, resulted in about 90,000 records stolen from Tully’s Coffee since October 2020 and 20,000 from JF Zengyoren since April 2021. Similar incidents have affected other companies, with the damage still spreading.

Authorities, including the Tokyo Metropolitan Police Department, suspect involvement by overseas criminal groups, given the presence of character strings common in certain regions. Investigators are analyzing IP addresses and other evidence to trace the attackers.

U.S.-based international development firm Chemonics International disclosed a data breach that exposed the personal information of more than 263,000 individuals. The breach began on May 30, 2023, with attackers roaming the company’s systems undetected for over six months. Despite discovering the breach in December 2023, unauthorized access continued until Jan. 9.

Chemonics is a large federal contractor that does copious business supporting U.S. Agency for International Development Projects including a $9.5 billion medical supply chain project.

Law firm Keesal, Young & Logan notified more than 316,000 individuals that their personally identifiable information – and in some cases, health information – was compromised in a cyber incident detected in June.

KYL in a report filed to regulators on Nov. 27 said the incident involved an “unauthorized actor” acquiring between June 7 and June 13 information stored on the firm’s network.

The law firm, which has offices in California, Washington state and Hong Kong, said it “moved quickly to secure its environment.”

The types of potentially compromised information includes individuals’ name, Social Security number, financial account information, driver’s license number, passport number, government identification number, date of birth, medical information, health insurance information, taxpayer identification number, biometric information and username/password.

A global law enforcement effort coordinated by Interpol under the banner of Operation HAECHI-V led to the arrest of more than 5,500 suspects and the seizure of $400 million in virtual and government-backed currencies. The operation, spanning July to November, involved authorities from 40 nations, tackling a range of financial crimes.

A crackdown led by Korean and Beijing authorities dismantled a voice phishing syndicate. The group, responsible for $1.1 billion in losses affecting over 1,900 victims, posed as law enforcement officials using fake IDs. Authorities arrested 27 suspects, indicting 19.

Interpol also issued a purple notice highlighting a growing cryptocurrency scam, the USDT Token Approval Scam. Scammers use romance-themed ploys to trick victims into buying Tether stablecoins via phishing links, granting scammers access to their wallets and funds.

This operation builds on prior successes, including a 2023 effort that arrested 3,500 suspects and seized $300 million globally, and an African-focused operation last week dismantling over 134,000 malicious networks.

The United Kingdom experienced a significant rise in severe cyberattacks in 2024, with nearly 100 nationally significant incidents reported, reported the National Cyber Security Center. The NCSC recorded 1,957 cyberattacks between September 2023 and August, with 89 affecting government and essential services. Of these, 12 were deemed “severe,” a three-fold increase from 2023.

NCSC CEO Richard Horne stated that hostile activity has grown in frequency, sophistication and intensity, largely driven by geopolitical tensions from the Russia-Ukraine war. Ransomware remained the top threat.

U.S. energy contractor ENGlobal disclosed that its IT systems remain restricted following a ransomware attack detected on Nov. 25. The breach locked some of ENGlobal files, though the extent of the data stolen is unclear.

The company said access to its systems is currently limited to essential operations. ENGlobal serves high-profile clients like the Department of Defense and Department of Energy and provides engineering, automation and construction services to critical infrastructure sectors. IT ENGlobal reported slightly more than $39 million in revenue during 2023.

With reporting from Information Security Media Group’s Akshaya Asokan in Southern England, Marianne Kolbasuk McGee in the Boston exurbs and David Perera in Washington, D.C.