Rewterz Threat Update – Rail Giant Wabtec Hit With Lockbit Ransomware

Severity

High

Analysis Summary

Wabtec Corporation, a rail and locomotive manufacturer based in the United States, has disclosed a data breach that exposed personal and sensitive information.

In 1999, the Westinghouse Air Brake Company (WABCO) and MotivePower Industries Corporation merged to become the American company Wabtec Corporation. The company employs over 25,000 employees and operates in 50 countries. It produces products for locomotives, freight cars, and passenger transit vehicles and constructs brand-new locomotives with a maximum power output of 6,000 horsepower.

Wabtec claims that as early as March 15th, 2022, threat actors broke into their network and installed malware on specified systems, according to a statement made at the year’s end. They discovered the unusual behavior on June 26 and immediately began an inquiry into the security concern.

“The forensic investigation did reveal that certain systems containing sensitive information were subject to unauthorized access, and that a certain amount of data was taken from the Wabtec environment on June 26, 2022. The information was later posted to the threat actor’s leak site. On November 23, 2022, Wabtec, with the assistance of data review specialists, determined that personal information was contained within the impacted files. On December 30, 2022, Wabtec began notifying affected individuals, per relevant regulations, with a formal letter, to let them know their data was involved.” – Webtec

In its announcement, the company made no indication of the attack’s nature. The fact that the stolen data was subsequently uploaded to a threat actor’s leak site serves as the only indication of an extortion attack. Wabtec determined that the data stolen by the attackers on November 23, 2022, contained personal information.

LockBit revealed samples of Wabtec data obtained and leaked all stolen data on August 20th, 2022, reportedly because a ransom was not paid.

source

The sensitive data that was disclosed in the stolen data included: Full Name, Date of Birth, Non-US National ID Number, Non-US Social Insurance Number or Fiscal Code, Passport Number, IP Address, Employer Identification Number (EIN), USCIS or Alien Registration Number, NHS (National Health Service) Number (UK), Medical Record/Health Insurance Information, Photograph, Gender/Gender Identity, Salary, Social Security Number (US), Financial Account Information, Payment Card Information, Account Username and Password, Biometric Information, Race/Ethnicity, Religious Beliefs, Union Affiliation, Criminal Conviction or Offense, and Orientation/life

Wabtec started alerting impacted individuals on December 30, 2022, and asked them to be attentive against cases of identity theft and fraud by monitoring their financial account statements and credit reports for any irregularities.

“While there is no indication that any specific information was or will be misused, considering the nature of the incident and of the affected personal data, we cannot rule out that there may be attempts to carry out fraudulent activity,” concludes Wabtec.

Impact

• Personal & Sensitive Information Theft
• Data Theft
• Infected Network & Internal Systems

Remediation

• Wabtec encourages individuals to be cautious against identity theft and fraud by reviewing their financial account statements and credit reports for any irregularities.
• Maintain cyber hygiene by updating your anti-virus software and implement patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Users should upgrade their applications and V3 to the most recent version and avoid opening documents from unknown sources.
• Never trust or open ” links and attachments received from unknown sources/senders.
• Enforced Access Management Policies
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.