therecord.media Open in urlscan Pro
2606:4700:4400::ac40:9b4b  Public Scan

URL: https://therecord.media/california-union-lockbit-attack-ransomware
Submission: On February 09 via api from TR — Scanned from DE

Form analysis 1 forms found in the DOM

<form><span class="text-black text-sm icon-search"></span><input type="text" name="s" placeholder="Search…" value=""><button type="submit">Go</button></form>

Text Content

This website stores cookies on your computer. These cookies are used to improve
your website experience and provide more personalized services to you, both on
this website and through other media. To find out more about the cookies we use,
see our Privacy Policy.

Accept

 * Leadership
 * Cybercrime
 * Nation-state
 * Elections
 * Technology

 * Cyber Daily®
 * Click Here Podcast

Go
Subscribe to The Record
✉️ Free Newsletter

Image: SEIU 1000
Jonathan Greig
February 8th, 2024
 * News
 * Cybercrime News

 * 
 * 
 * 
 * 
 * 

Get more insights with the
Recorded Future
Intelligence Cloud.
Learn more.


CALIFORNIA UNION CONFIRMS RANSOMWARE ATTACK FOLLOWING LOCKBIT CLAIMS

One of the largest unions in California confirmed this week that it is dealing
with network disruptions due to a cyber incident following claims of an attack
last month by a notorious ransomware gang.

Service Employees International Union (SEIU) Local 1000 represents nearly
100,000 state employees in California across more than 2,000 worksites in the
state.

Last month, the LockBit ransomware gang said it stole 308 gigabytes of data from
the union that included employee Social Security numbers, salary information,
financial documents and more.

The organization did not respond to repeated requests for comment but addressed
the issue in a public statement this week, confirming that on January 18 they
“experienced a network disruption by an outside actor.”

“As we investigated the incident we learned that it was caused by certain data
being encrypted. We are aware of the discussion happening on social media about
the type of attack we are purported to have had and the actor by whom it was
apparently done,” they said in reference to LockBit’s claims.

“We are currently working with outside experts to ensure ongoing network
security and assist and advise as we continue to restore our operations. This
incident was a criminal cyber act and is being treated as such as we assist law
enforcement.”

The organization is in the process of determining what personal information was
stolen or accessed during the attack and plans to notify anyone affected. Free
credit monitoring and identity theft protection services will be offered to
victims, they added.

The attack “has caused concern and also inconvenience” but work has proceeded in
spite of the outages. State agencies have continued to work with them on ongoing
bargaining issues, cases, grievances, hearings, and meetings.

“As we fully bring our systems back online, we have never stopped fighting for
the rights of state workers,” the statement explained. “Coordinated attacks
against unions come from a number of anti-worker groups, and we will not let
this one distract us from the important issues that face us with the State, the
budget process or any of the upcoming political primary battles.”

The organization’s website now included a banner notifying people of the network
disruptions and providing a phone number for those with questions.

Institutions in California continue to face a barrage of cyberattacks, from
ransomware gangs like LockBit and other groups. At least seven cities, including
San Francisco, Oakland and Hayward, have been hit by ransomware attacks and
hackers have pilfered data from the California’s Public Employees' Retirement
System (CalPERS) as well as a California-based company that controls 16
hospitals across the country and a major pro bono law firm.

 * 
 * 
 * 
 * 
 * 

Tags
 * Ransomware
 * California
 * LockBit

Previous articleNext article
Ukraine's cyberattacks on Russia aiding ground operations, top Kyiv cyber
official says
US offers $10 million reward for info on Hive ransomware gang members

Jonathan Greig



Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has
worked across the globe as a journalist since 2014. Before moving back to New
York City, he worked for news outlets in South Africa, Jordan and Cambodia. He
previously covered cybersecurity at ZDNet and TechRepublic.

 * Funerals reportedly canceled due to ransomware attack on Austrian
   townFebruary 8th, 2024
 * Coker: ONCD is studying ‘liability regimes’ for software flawsFebruary 7th,
   2024
 * Google agrees to $350 million settlement over data leakFebruary 6th, 2024
 * Municipalities in US, Spain dealing with outages from cyberattacksFebruary
   5th, 2024
 * American businessman settles hacking case in UK against law firmFebruary 5th,
   2024
 * Former CIA officer who gave WikiLeaks state secrets gets 40-year
   sentenceFebruary 2nd, 2024
 * US announces another arrest in BTC-e cybercrime caseFebruary 1st, 2024
 * Interpol arrests more than 30 cybercriminals in global ‘Synergia’
   operationFebruary 1st, 2024
 * India-linked hackers target Pakistan with spyware in new campaignFebruary
   1st, 2024


PATTERNS AND TARGETS FOR RANSOMWARE EXPLOITATION OF VULNERABILITIES: 2017–2023


Patterns and Targets for Ransomware Exploitation of Vulnerabilities: 2017–2023


LEAKS AND REVELATIONS: A WEB OF IRGC NETWORKS AND CYBER COMPANIES


Leaks and Revelations: A Web of IRGC Networks and Cyber Companies


FLYING UNDER THE RADAR: ABUSING GITHUB FOR MALICIOUS INFRASTRUCTURE


Flying Under the Radar: Abusing GitHub for Malicious Infrastructure


2023 ADVERSARY INFRASTRUCTURE REPORT


2023 Adversary Infrastructure Report


ANNUAL PAYMENT FRAUD INTELLIGENCE REPORT: 2023


Annual Payment Fraud Intelligence Report: 2023
 * 
 * 
 * 
 * 

 * Privacy
 * About
 * Contact Us

© Copyright 2024 | The Record from Recorded Future News