Rewterz Threat Alert – Play Ransomware Gang Leaks Data Stolen From City of Oakland

Severity

High

Analysis Summary

The Play ransomware group has now begun to disclose the data obtained in a recent attack against the City of Oakland. The ransomware attack was publicly disclosed by the City of Oakland on February 10, 2023. The security breach started on February 8, 2023. The City of Oakland took the affected systems offline to secure the impacted infrastructure.

The Play ransomware gang’s recent attack on the City of Oakland, California, is concerning as it has resulted in the theft and subsequent leak of sensitive data. The leaked data, which includes confidential documents, employee information, passports, and IDs, puts the affected individuals at risk of identity theft and other forms of cybercrime. 

“Private and personal confidential data, financial information. IDs, passports, employee full info, human rights violation information. For now partially published compressed 10gb,” stated the threat actor on their data leak site.

On March 3, the City reported that an unauthorized third party had obtained specific data from its network and threatened to publicise the information.

“While the investigation into the scope of the incident impacting the City of Oakland remains ongoing, we recently became aware that an unauthorized third party has acquired certain files from our network and intends to release the information publicly.” according to the update published by the City.

We are working with third-party specialists and law enforcement on this issue and are actively monitoring the unauthorized third party’s claims to investigate their validity. If we determine that any individual’s personal information is involved, we will notify those individuals in accordance with applicable law.” they stated.

Although the City’s announcement confirms that its primary operations—including 911, financial information, and fire and rescue resources—were unaffected, it warns the public about potential delays as a result of the attack.

Oakland subsequently announced a local state of emergency to enable the City to quicken orders, purchase of supplies and equipment, and activation of emergency personnel as necessary.

Overall, the Play Ransomware gang’s attack on the City of Oakland and the subsequent leak of data is a reminder of the significant risks posed by ransomware attacks. It underscores the need for organizations to implement strong security measures to protect themselves from these types of attacks and to be prepared to respond quickly and effectively if an attack does occur.

Impact

• Sensitive Data Theft
• IT Systems Disruption

Remediation

• Secure your systems – The first step is to ensure that your systems are secure and protected against further attacks. This includes updating all software and security patches, reviewing and enhancing your cybersecurity policies and procedures, and deploying advanced threat protection solutions like endpoint protection, intrusion detection and prevention, and network segmentation.
• It is important to closely monitor your networks for any signs of suspicious activity, including abnormal traffic patterns or unusual login attempts. Implement a robust security information and event management (SIEM) system to help detect any potential threats in real-time.
• Check your backup systems to ensure that they are working properly and that all critical data is being backed up regularly. Additionally, test the integrity of your backups by restoring a sample of data and verifying its completeness.
• Ensure that you have an up-to-date incident response plan in place, which outlines the steps to take in the event of a cybersecurity incident. Conduct tabletop exercises and drills to test your plan and ensure that your team is prepared to respond effectively.
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Never trust or open links and attachments received from unknown sources/senders.