cybernews.com Open in urlscan Pro
2606:4700:3108::ac42:283b  Public Scan

Form analysis
2 forms found in the DOM

GET /search/

<form class="header__search-form" action="/search/" method="get" data-js-search-mobile="">
  <input class="header__search-form-input" placeholder="Search..." type="search" data-js-search-input-mobile="">
  <button type="submit" class="header__search-form-button" title="Search">
    <svg class="svg-icon header__search-form-button-icon" width="22" height="22">
      <use xlink:href="#mdi-magnify"></use>
    </svg>
  </button>
</form>

POST /api/add-comment/

<form id="comment-form" class="space space_size_n text text_size_small" action="/api/add-comment/" method="POST">
  <label for="comment-form-text">
    <strong class="form-label form-label_required">Comment</strong>
    <textarea id="comment-form-text" name="comment" required="" cols="45" rows="8" class="form-input space space_size_s" minlength="3"></textarea>
  </label>
  <div class="space space_size_n">
    <div class="cells cells_responsive">
      <label class="cells__item cells__item_width cells__item_width_2" for="comment-form-name">
        <strong class="form-label form-label_required">Name</strong>
        <input id="comment-form-name" type="text" name="name" required="" class="form-input space space_size_s" minlength="3">
      </label>
      <label class="cells__item cells__item_width cells__item_width_2" for="comment-form-email">
        <strong class="form-label form-label_required">Email</strong>
        <input id="comment-form-email" type="email" name="email" required="" class="form-input space space_size_s" minlength="3">
      </label>
    </div>
    <label class="space space_size_n display_block" for="privacy_policy">
      <strong class="form-label form-label_required">Privacy Policy Agreement</strong>
      <span class="space space_size_s content display_block">
        <input id="privacy_policy" name="privacy_policy" required="" type="checkbox"> &nbsp; I agree to the <a class="link" href="https://cybernews.com/terms-conditions/" target="_blank" rel="noreferrer">
Terms &amp; Conditions
</a> and <a href="https://cybernews.com/privacy-policy/" target="_blank" rel="noreferrer">
Privacy Policsy
</a>. </span>
    </label>
  </div>
  <div class="space space_size_l">
    <button class="button" type="submit"> Post comment </button>
  </div>
</form>

Text Content

 * News
   * Cybersecurity news
   * Cyber war news
 * Editorial
 * Security
 * Privacy
 * Crypto
 * Tech
 * Resources
   * What is a VPN?
   * How to use a VPN?
   * What is malware?
   * Are password managers safe?
   * More resources
 * Tools
   * Strong password generator
   * Personal data leak checker
   * Password leak checker
   * Website security checker
   * Ransomlooker
   * VPN speed test
 * Reviews
   * Antivirus software
   * Best VPN services
   * Password managers
   * Best ad blockers
   * Secure email providers
   * Best website builders
   * Best web hosting services

 * Follow
   * 
   * 
   * 
   * 
   * 
   * 
   * 



© 2023 CyberNews- Latest tech news,
product reviews, and analyses.

 1. Home
 2. Security


DOLLY.COM PAYS RANSOM, ATTACKERS RELEASE DATA ANYWAY

Updated on: 15 November 2023
6
 * Vilius Petkauskas
   Deputy Editor

--------------------------------------------------------------------------------

Image by Cybernews.


Dolly.com, an on-demand moving and delivery platform, allegedly paid attackers
not to publish stolen customer data. Unsurprisingly, cybercrooks found an excuse
not to hold their end of the bargain.

Cybercriminals are hardly a trustworthy bunch. Case in point: Dolly.com. The
Cybernews research team believes that the platform suffered a ransomware attack
and at least partially paid the ransom – but was duped.

The attackers complained that the payment wasn’t generous enough and published
the stolen data. Not only that, but the criminals also shared a chat with the
company on an underground criminal forum.



We have reached out to Dolly.com to confirm whether the company suffered a
ransomware attack and opted to pay the ransom, but we did not receive a reply
before publishing.


THE ATTACK ON DOLLY.COM

Dolly.com offers on-demand moving and delivery services in 45 US cities. The
platform connects people who need help moving items with “Dolly helpers” who can
assist with the heavy lifting.

Attackers posted details about the Dolly.com hack on a notorious
Russian-language forum, typically employed by ransomware operators and stolen
data traders.

The company was likely breached sometime in late August or early September. One
of the emails between the attackers and the victim, dated September 7th, showed
that Dolly.com agreed to pay the ransom.

Image by Cybernews.

In exchange, the attackers were asked to delete the stolen information. Our
researchers believe that the cybercriminals obtained sensitive company and
customer data such as:

 * High-level account login details
 * Credit card information
 * Customer addresses
 * Names
 * Registration dates
 * User emails
 * System data



The team believes the stolen credit card data includes at least the last four
numbers and the card’s type. However, attackers said they had access to the
entire credit card data.

Our researchers also noted that the criminal forum post included entry points
for MongoDB instances hosted on Amazon Web Services (AWS) cloud, along with
their admin credentials to internal Dolly.com systems.

“Moreover, all 95 AWS S3 bucket names that were hacked and belonged to
Dolly.com, including backups, were attached within the post. Normally, this data
type is also considered sensitive,” researchers said.


INSUFFICIENT PAYMENT

According to the attackers’ version of events, Dolly.com did pay the ransom, but
it was not enough to satisfy them. Unsurprisingly, the gang did not return the
payment that it deemed too small. Instead, the crooks kept the money and the
data.

To add salt to the wound, the attackers uploaded the data and posted two
download links on a forum infested with cybercriminals. Not only did the company
allegedly lose money and data, but its attempt to mute the attack also failed.
The only silver lining is that the downloadable files were later removed after
being up for at least a week.

“Dolly.com paid the ransomware operator to avoid the attack going public. The
attackers felt the sum was insufficient. This was later presented as the main
motivation to publicize the hack and announce a data auction along with sample
files and free-downloadable archive dumps,” our researchers said.

The case illustrates how ransomware operators can never be trusted, as there is
no guarantee that victims who pay up won’t lose their money and data.

“If no precautions are taken, this attack might lead to many more subsequent
attacks,” researchers said.

To mitigate the problems and avoid further security incidents, the team advises
breached companies to:


 * Retrospectively investigate all the logs to see if the hacker’s claims are
   valid
 * Reset all internal tokens and other exposed sensitive or internal variables
 * Inform all the platform’s users of the hack and its possible implications
 * Perform a full-scale audit of the organization’s security posture



--------------------------------------------------------------------------------


MORE FROM CYBERNEWS:

Book review – Going Infinite: The Rise and Fall of a New Tycoon

Boeing data leaked, attackers promise more

The man who found a world: detecting an exoplanet

The hacker who breached NASA to prove that UFOs exist

NASA launches its own space Netflix

Subscribe to our newsletter


Share
Post
Share
Share
Share

--------------------------------------------------------------------------------

Editor's choice
EDITORIAL
Book review: “A City on Mars”
by  Jurgita Lapienytė
03 December 2023

Zack and Kelly Weinersmith “A City on Mars: Can We Settle Space, Should We
Settle Space, and Have We Really Thought This Through” book review.

Read more about Zack and Kelly Weinersmith “A City on Mars: Can We Settle Space,
Should We Settle Space, and Have We Really Thought This Through” book review.
Spot the Artist: a robot dog takeover at NGV Triennial in Melbourne
01 December 2023
One year on: how ChatGPT brought AI to the masses
30 November 2023
KidSecurity’s user data compromised after app failed to set password
29 November 2023
Exclusive: Hacker breaks silence following a decade behind bars in Cybernews
documentary
27 November 2023

--------------------------------------------------------------------------------



--------------------------------------------------------------------------------

--------------------------------------------------------------------------------


COMMENTS

Daniel White
prefix 21 days ago
There's a valuable lesson here. By paying up, it encourages more and why on
earth they trusted someone who was dishonest to begin with I couldnt begin to
fathom.
Lexx
prefix 22 days ago
You should never pay anyway but this one ransomware group has likely caused a
lot of problems for them self's now and others (as in even less likely to pay)
MadAntz
prefix 22 days ago
You never pay a ransom. Why? You may not get your data, they will probably
release it anyway and most importantly it will make them and others do it again.
Anything that's profitable is worth doing.
Carl
prefix 22 days ago
This may actualy teach companies not to pay. They need to higher better
programmers to keep the information offline not connected to the internet
...
prefix 22 days ago
Not setting a good standard for other ransomeware attacks lol, big companies
targeted in the future now know not to pay
ChipBoundary
prefix 23 days ago
Congratulations, you broke the law AND compromised your customers! Well done!
Leave a Reply

Your email address will not be published. Required fields are markedmarked

Comment
Name Email
Privacy Policy Agreement   I agree to the Terms & Conditions and Privacy Policsy
.
Post comment

 * Categories
   * News
   * Editorial
   * Security
   * Privacy
   * Crypto
   * Cloud
   * Tech
 * Reviews
   * Antivirus Software
   * Password Managers
   * Best VPNs
   * Best VPN for iPhone
   * Secure Email Providers
   * Website Builders
   * Best Web Hosting Services
 * Tools
   * Password generator
   * Personal data leak checker
   * Password leak checker
   * Website security checker
   * Ransomlooker
   * VPN speed test
   * Coupon codes
 * ENGAGE
   * About Us
   * Send Us a Tip
   * Careers
   * Academy

 * 
 * 
 * 
 * 
 * 
 * 
 * 

 * About Us
 * Contact
 * Send Us a Tip
 * Privacy Policy
 * Terms & Conditions
 * Vulnerability Disclosure

© 2023 Cybernews – Latest Cybersecurity and Tech News, Research & Analysis.



This website uses cookies. By continuing to use this website you are giving
consent to cookies being used. Visit our Privacy Policy .
Customize I Agree