A recent ransomware attack by BlackSuit has compromised the personal data of 954,177 individuals, prompting a mass notification effort by the affected software vendor, now known as Connexure. The Atlanta-based firm, which specializes in software solutions for the employer stop-loss insurance market, is informing nearly a million people about the breach, which occurred on April 10, 2024.
Connexure, formerly Young Consulting, serves insurance carriers, brokers, and third-party administrators, providing them with tools for managing, marketing, and administering stop-loss insurance policies. The breach affected members of various organizations, including some affiliated with Blue Shield of California, whose sensitive data was stolen during the attack.
Although the breach happened on April 10, the company only became aware of it three days later when the ransomware encrypted its systems. After a thorough investigation, which concluded on June 28, it was revealed that the compromised information included full names, Social Security numbers (SSNs), dates of birth, and insurance claim details.
In response, the company is offering 12 months of free credit monitoring services through a security provider to those affected, with a deadline to enroll by the end of November 2024. Given that BlackSuit has already leaked the stolen data on its darknet extortion platform, it is crucial for the impacted individuals to take advantage of this protective measure immediately. They should also be on high alert for any suspicious communications, phishing attempts, or scams that may follow this breach.
The attackers publicly took responsibility for the breach on May 7 and made good on their threat to release the stolen data when their extortion demands were not met.
According to the attackers, the leaked information extends beyond what the software vendor disclosed in its notices, allegedly including business contracts, contact lists, presentations, employee passports, medical records, financial audits, and other sensitive content from personal folders and network shares.
BlackSuit’s malicious activities have led to significant financial losses for American companies this year, with one of the most notable incidents being the major outage at CDK Global. Earlier this month, reports indicated that BlackSuit is a rebranded version of Royal ransomware and has demanded over $500 million in ransoms over the past two years.
To mitigate the risk of falling victim to further exploitation, affected individuals should immediately enroll in the provided credit monitoring service and stay vigilant against potential phishing attempts or fraudulent activities. Organizations can prevent similar breaches by investing in advanced cybersecurity measures, conducting regular security audits, and educating employees about the latest ransomware tactics to reduce the likelihood of future attacks.
