Wabtec Corporation, a rail and locomotive manufacturer based in the United States, has disclosed a data breach that exposed personal and sensitive information.
In 1999, the Westinghouse Air Brake Company (WABCO) and MotivePower Industries Corporation merged to become the American company Wabtec Corporation. The company employs over 25,000 employees and operates in 50 countries. It produces products for locomotives, freight cars, and passenger transit vehicles and constructs brand-new locomotives with a maximum power output of 6,000 horsepower.
Wabtec claims that as early as March 15th, 2022, threat actors broke into their network and installed malware on specified systems, according to a statement made at the year’s end. They discovered the unusual behavior on June 26 and immediately began an inquiry into the security concern.
“The forensic investigation did reveal that certain systems containing sensitive information were subject to unauthorized access, and that a certain amount of data was taken from the Wabtec environment on June 26, 2022. The information was later posted to the threat actor’s leak site. On November 23, 2022, Wabtec, with the assistance of data review specialists, determined that personal information was contained within the impacted files. On December 30, 2022, Wabtec began notifying affected individuals, per relevant regulations, with a formal letter, to let them know their data was involved.” – Webtec
In its announcement, the company made no indication of the attack’s nature. The fact that the stolen data was subsequently uploaded to a threat actor’s leak site serves as the only indication of an extortion attack. Wabtec determined that the data stolen by the attackers on November 23, 2022, contained personal information.
LockBit revealed samples of Wabtec data obtained and leaked all stolen data on August 20th, 2022, reportedly because a ransom was not paid.
The sensitive data that was disclosed in the stolen data included: Full Name, Date of Birth, Non-US National ID Number, Non-US Social Insurance Number or Fiscal Code, Passport Number, IP Address, Employer Identification Number (EIN), USCIS or Alien Registration Number, NHS (National Health Service) Number (UK), Medical Record/Health Insurance Information, Photograph, Gender/Gender Identity, Salary, Social Security Number (US), Financial Account Information, Payment Card Information, Account Username and Password, Biometric Information, Race/Ethnicity, Religious Beliefs, Union Affiliation, Criminal Conviction or Offense, and Orientation/life
Wabtec started alerting impacted individuals on December 30, 2022, and asked them to be attentive against cases of identity theft and fraud by monitoring their financial account statements and credit reports for any irregularities.
“While there is no indication that any specific information was or will be misused, considering the nature of the incident and of the affected personal data, we cannot rule out that there may be attempts to carry out fraudulent activity,” concludes Wabtec.