www.bleepingcomputer.com
Open in
urlscan Pro
104.20.60.209
Public Scan
URL:
https://www.bleepingcomputer.com/news/security/shutterfly-services-disrupted-by-conti-ransomware-attack/
Submission: On April 18 via api from US — Scanned from DE
Submission: On April 18 via api from US — Scanned from DE
Form analysis 6 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" name="EMAIL" aria-label="Enter email address" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" aria-label="Enter email address" name="EMAIL" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/shutterfly-services-disrupted-by-conti-ransomware-attack/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/shutterfly-services-disrupted-by-conti-ransomware-attack/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/shutterfly-services-disrupted-by-conti-ransomware-attack/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.
With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
*
*
*
*
*
*
* News
* Featured
* Latest
* Cisco vulnerability lets hackers craft their own login credentials
* T-Mobile customers warned of unblockable SMS phishing attacks
* 'Mute' button in conferencing apps may not actually mute your mic
* Karakurt revealed as data extortion arm of Conti cybercrime syndicate
* Manage your passwords with an Enpass lifetime subscription deal
* Customize Windows 11 experience with these apps
* Microsoft: Office 2013 will reach end of support in April 2023
* Learn how to manage networks with this Cisco certification bundle deal
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove the Smashapps.net Search Redirect
* Remove the Smashappsearch.com Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to Translate a Web Page in Google Chrome
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* File Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* Shutterfly services disrupted by Conti ransomware attack
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditRedditShare to Hacker NewsHacker NewsShare to
EmailEmail
*
SHUTTERFLY SERVICES DISRUPTED BY CONTI RANSOMWARE ATTACK
By
LAWRENCE ABRAMS
* December 27, 2021
* 02:56 AM
* 0
Photography and personalized photo giant Shutterfly has suffered a Conti
ransomware attack that allegedly encrypted thousands of devices and stole
corporate data.
Although many associate Shutterfly with their website, the company's
photography-related services are aimed at consumer, enterprise, and education
customers through various brands such as GrooveBook,
BorrowLenses, Shutterfly.com, Snapfish, and Lifetouch.
The main website can be used to upload photos to create photo books,
personalized stationary, greeting cards, post cards, and more.
PLAY Top Articles Video Settings Full Screen About Connatix V159143 Read More
Read More Read More Read More Read More Read More Customize Windows 11
experience withthese apps 1/1 Skip Ad Continue watching after the ad Visit
Advertiser websiteGO TO PAGE
SHUTTERFLY SUFFERS A CONTI RANSOMWARE ATTACK
On Friday, a source told BleepingComputer that Shutterfly suffered a ransomware
attack approximately two weeks ago by the Conti gang, who claims to have
encrypted over 4,000 devices and 120 VMware ESXi servers.
While BleepingComputer has not seen the negotiations for the attack, we are told
that they are in progress and that the ransomware gang is demanding millions of
dollars as a ransom.
Before ransomware gangs encrypt devices on corporate networks, they commonly
lurk inside for days, if not weeks, stealing corporate data and documents. These
documents are then used as leverage to force a victim to pay a ransom under the
threat that they will be publicly released or sold to other hackers.
Conti has created a private Shutterfly data leak page containing screenshots of
files allegedly stolen during the ransomware attack, as part of this "
double-extortion" tactic. The attackers threaten to make this page public if a
ransom is not paid.
Private data leak page on Conti dark web site
BleepingComputer has been told that these screenshots include legal agreements,
bank and merchant account info, login credentials for corporate services,
spreadsheets, and what appears to be customer information, including the last
four digits of credit cards.
Conti also claims to have the source code for Shutterfly's store, but it is
unclear if the ransomware gang means Shutterfly.com or another website.
After contacting Shutterfly on Friday about the attack, BleepingCompuer was sent
a statement confirming the ransomware attack late Sunday night.
This statement, shown in its entirety below, says that the Shutterfly.com,
Snapfish, TinyPrints, or Spoonflower sites were not affected by the attack.
However, their corporate network, Lifetouch, BorrowLeneses, and Groovebook had
disrupted services.
> "Shutterfly, LLC recently experienced a ransomware attack on parts of our
> network. This incident has not impacted our Shutterfly.com, Snapfish,
> TinyPrints or Spoonflower sites. However, portions of our Lifetouch and
> BorrowLenses business, Groovebook, manufacturing and some corporate systems
> have been experiencing interruptions. We engaged third-party cybersecurity
> experts, informed law enforcement, and have been working around the clock to
> address the incident."
>
> "As part of our ongoing investigation, we are also assessing the full scope of
> any data that may have been affected. We do not store credit card, financial
> account information or the Social Security numbers of our Shutterfly.com,
> Snapfish, Lifetouch, TinyPrints, BorrowLenses, or Spoonflower customers, and
> so none of that information was impacted in this incident. However,
> understanding the nature of the data that may have been affected is a key
> priority and that investigation is ongoing. We will continue to provide
> updates as appropriate." - Shutterfly.
While Shutterfly states that no financial information was disclosed,
BleepingComputer was told that one of the screenshots contains the last four
digits of credit cards, so it is unclear if there is further, and more
concerning, information stolen during the attack.
When BleepingComputer reached out to Shutterfly about the screenshot they
referred us back to the original statement.
THE CONTI RANSOMWARE GANG
Conti is a ransomware operation believed to be operated by a Russian hacking
group known for other notorious malware infections, such as Ryuk, TrickBot, and
BazarLoader.
This operation runs as a Ransomware-as-a-Service, where the core team develops
the ransomware, maintains payment and data leak sites, and negotiates with
victims. They then recruit "affiliates" who breach the corporate network, steal
data, and encrypt devices.
As part of this arrangement, ransom payments are split between the core group
and the affiliate, with the affiliate usually receiving 70-80% of the total
amount.
Conti commonly breaches a network after a corporate device becomes infected with
the BazarLoader or TrickBot malware infections, which provide remote access to
the hacking group.
Once they gain access to an internal system, they spread through the network,
harvest data, and deploy the ransomware.
Conti is known for attacks on other high-profile organizations in the past,
including Ireland's Health Service Executive (HSE) and Department of Health
(DoH), the City of Tulsa, Broward County Public Schools, and Advantech.
Due to the increased activity by the cybercrime gang, the US government recently
issued an advisory on Conti ransomware attacks.
Update 12/27/21: Updated with response about financial information in stolen
data.
RELATED ARTICLES:
Wind turbine firm Nordex hit by Conti ransomware attack
Hackers use Conti's leaked ransomware to attack Russian companies
Shutterfly discloses data breach after Conti ransomware attack
The Week in Ransomware - April 15th 2022 - Encrypting Russia
Karakurt revealed as data extortion arm of Conti cybercrime syndicate
* Conti
* Cyberattack
* Ransomware
* Shutterfly
* Vmware ESXi
* Facebook
* Twitter
* LinkedIn
* Email
*
LAWRENCE ABRAMS
Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com.
Lawrence's area of expertise includes Windows, malware removal, and computer
forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation,
Recovery, and Administration Field Guide and the technical editor for Rootkits
for Dummies.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* GitHub suspends accounts of Russian devs at sanctioned companies
* Customize Windows 11 experience with these apps
NEWSLETTER SIGN UP
To receive periodic updates and news from BleepingComputer, please use the form
below.
NEWSLETTER SIGN UP
* Follow us:
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* File Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2022 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT