cybernews.com
Open in
urlscan Pro
2606:4700:3108::ac42:2bc5
Public Scan
URL:
https://cybernews.com/security/dolly-data-breach-ransomware-attack/
Submission: On December 03 via api from US — Scanned from DE
Submission: On December 03 via api from US — Scanned from DE
Form analysis 2 forms found in the DOM
GET /search/
<form class="header__search-form" action="/search/" method="get" data-js-search-mobile="">
<input class="header__search-form-input" placeholder="Search..." type="search" data-js-search-input-mobile="">
<button type="submit" class="header__search-form-button" title="Search">
<svg class="svg-icon header__search-form-button-icon" width="22" height="22">
<use xlink:href="#mdi-magnify"></use>
</svg>
</button>
</form>POST /api/add-comment/
<form id="comment-form" class="space space_size_n text text_size_small" action="/api/add-comment/" method="POST">
<label for="comment-form-text">
<strong class="form-label form-label_required">Comment</strong>
<textarea id="comment-form-text" name="comment" required="" cols="45" rows="8" class="form-input space space_size_s" minlength="3"></textarea>
</label>
<div class="space space_size_n">
<div class="cells cells_responsive">
<label class="cells__item cells__item_width cells__item_width_2" for="comment-form-name">
<strong class="form-label form-label_required">Name</strong>
<input id="comment-form-name" type="text" name="name" required="" class="form-input space space_size_s" minlength="3">
</label>
<label class="cells__item cells__item_width cells__item_width_2" for="comment-form-email">
<strong class="form-label form-label_required">Email</strong>
<input id="comment-form-email" type="email" name="email" required="" class="form-input space space_size_s" minlength="3">
</label>
</div>
<label class="space space_size_n display_block" for="privacy_policy">
<strong class="form-label form-label_required">Privacy Policy Agreement</strong>
<span class="space space_size_s content display_block">
<input id="privacy_policy" name="privacy_policy" required="" type="checkbox"> I agree to the <a class="link" href="https://cybernews.com/terms-conditions/" target="_blank" rel="noreferrer">
Terms & Conditions
</a> and <a href="https://cybernews.com/privacy-policy/" target="_blank" rel="noreferrer">
Privacy Policsy
</a>. </span>
</label>
</div>
<div class="space space_size_l">
<button class="button" type="submit"> Post comment </button>
</div>
</form>Text Content
* News * Cybersecurity news * Cyber war news * Editorial * Security * Privacy * Crypto * Tech * Resources * What is a VPN? * How to use a VPN? * What is malware? * Are password managers safe? * More resources * Tools * Strong password generator * Personal data leak checker * Password leak checker * Website security checker * Ransomlooker * VPN speed test * Reviews * Antivirus software * Best VPN services * Password managers * Best ad blockers * Secure email providers * Best website builders * Best web hosting services * Follow * * * * * * * © 2023 CyberNews- Latest tech news, product reviews, and analyses. 1. Home 2. Security DOLLY.COM PAYS RANSOM, ATTACKERS RELEASE DATA ANYWAY Updated on: 15 November 2023 6 * Vilius Petkauskas Deputy Editor -------------------------------------------------------------------------------- Image by Cybernews. Dolly.com, an on-demand moving and delivery platform, allegedly paid attackers not to publish stolen customer data. Unsurprisingly, cybercrooks found an excuse not to hold their end of the bargain. Cybercriminals are hardly a trustworthy bunch. Case in point: Dolly.com. The Cybernews research team believes that the platform suffered a ransomware attack and at least partially paid the ransom – but was duped. The attackers complained that the payment wasn’t generous enough and published the stolen data. Not only that, but the criminals also shared a chat with the company on an underground criminal forum. We have reached out to Dolly.com to confirm whether the company suffered a ransomware attack and opted to pay the ransom, but we did not receive a reply before publishing. THE ATTACK ON DOLLY.COM Dolly.com offers on-demand moving and delivery services in 45 US cities. The platform connects people who need help moving items with “Dolly helpers” who can assist with the heavy lifting. Attackers posted details about the Dolly.com hack on a notorious Russian-language forum, typically employed by ransomware operators and stolen data traders. The company was likely breached sometime in late August or early September. One of the emails between the attackers and the victim, dated September 7th, showed that Dolly.com agreed to pay the ransom. Image by Cybernews. In exchange, the attackers were asked to delete the stolen information. Our researchers believe that the cybercriminals obtained sensitive company and customer data such as: * High-level account login details * Credit card information * Customer addresses * Names * Registration dates * User emails * System data The team believes the stolen credit card data includes at least the last four numbers and the card’s type. However, attackers said they had access to the entire credit card data. Our researchers also noted that the criminal forum post included entry points for MongoDB instances hosted on Amazon Web Services (AWS) cloud, along with their admin credentials to internal Dolly.com systems. “Moreover, all 95 AWS S3 bucket names that were hacked and belonged to Dolly.com, including backups, were attached within the post. Normally, this data type is also considered sensitive,” researchers said. INSUFFICIENT PAYMENT According to the attackers’ version of events, Dolly.com did pay the ransom, but it was not enough to satisfy them. Unsurprisingly, the gang did not return the payment that it deemed too small. Instead, the crooks kept the money and the data. To add salt to the wound, the attackers uploaded the data and posted two download links on a forum infested with cybercriminals. Not only did the company allegedly lose money and data, but its attempt to mute the attack also failed. The only silver lining is that the downloadable files were later removed after being up for at least a week. “Dolly.com paid the ransomware operator to avoid the attack going public. The attackers felt the sum was insufficient. This was later presented as the main motivation to publicize the hack and announce a data auction along with sample files and free-downloadable archive dumps,” our researchers said. The case illustrates how ransomware operators can never be trusted, as there is no guarantee that victims who pay up won’t lose their money and data. “If no precautions are taken, this attack might lead to many more subsequent attacks,” researchers said. To mitigate the problems and avoid further security incidents, the team advises breached companies to: * Retrospectively investigate all the logs to see if the hacker’s claims are valid * Reset all internal tokens and other exposed sensitive or internal variables * Inform all the platform’s users of the hack and its possible implications * Perform a full-scale audit of the organization’s security posture -------------------------------------------------------------------------------- MORE FROM CYBERNEWS: Book review – Going Infinite: The Rise and Fall of a New Tycoon Boeing data leaked, attackers promise more The man who found a world: detecting an exoplanet The hacker who breached NASA to prove that UFOs exist NASA launches its own space Netflix Subscribe to our newsletter Share Post Share Share Share -------------------------------------------------------------------------------- Editor's choice SECURITY KidSecurity’s user data compromised after app failed to set password by Paulina Okunytė 29 November 2023 KidSecurity, a popular parental control app that’s used to track children, has exposed its activity logs, leaving users' private data in the hands of threat actors. Read more about KidSecurity, a popular parental control app that’s used to track children, has exposed its activity logs, leaving users' private data in the hands of threat actors. Exclusive: Hacker breaks silence following a decade behind bars in Cybernews documentary 27 November 2023 Thousands of secrets lurk in app images on Docker Hub 28 November 2023 China vs US: who’s winning the race for AI supremacy 27 November 2023 Cybernews podcast: Five days of war at OpenAI 23 November 2023 -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- COMMENTS Daniel White prefix 17 days ago There's a valuable lesson here. By paying up, it encourages more and why on earth they trusted someone who was dishonest to begin with I couldnt begin to fathom. Lexx prefix 17 days ago You should never pay anyway but this one ransomware group has likely caused a lot of problems for them self's now and others (as in even less likely to pay) MadAntz prefix 18 days ago You never pay a ransom. Why? You may not get your data, they will probably release it anyway and most importantly it will make them and others do it again. Anything that's profitable is worth doing. Carl prefix 18 days ago This may actualy teach companies not to pay. They need to higher better programmers to keep the information offline not connected to the internet ... prefix 18 days ago Not setting a good standard for other ransomeware attacks lol, big companies targeted in the future now know not to pay ChipBoundary prefix 19 days ago Congratulations, you broke the law AND compromised your customers! Well done! Leave a Reply Your email address will not be published. Required fields are markedmarked Comment Name Email Privacy Policy Agreement I agree to the Terms & Conditions and Privacy Policsy . Post comment * Categories * News * Editorial * Security * Privacy * Crypto * Cloud * Tech * Reviews * Antivirus Software * Password Managers * Best VPNs * Best VPN for iPhone * Secure Email Providers * Website Builders * Best Web Hosting Services * Tools * Password generator * Personal data leak checker * Password leak checker * Website security checker * Ransomlooker * VPN speed test * Coupon codes * ENGAGE * About Us * Send Us a Tip * Careers * Academy * * * * * * * * About Us * Contact * Send Us a Tip * Privacy Policy * Terms & Conditions * Vulnerability Disclosure © 2023 Cybernews – Latest Cybersecurity and Tech News, Research & Analysis. This website uses cookies. By continuing to use this website you are giving consent to cookies being used. Visit our Privacy Policy . I Agree