Hackers Demand as Much as $5 Million From Snowflake Clients

Cybercriminals are demanding payments of between $300,000 and $5 million apiece from as many as 10 companies breached in a campaign that targeted Snowflake customers, according to a security firm helping with the investigation. From a report: The hacking scheme has entered a "new stage" as the gang looks to profit from the most valuable information it has stolen, said Austin Larsen, a senior threat analyst at Google's Mandiant security business, which helped lead Snowflake's inquiry. That includes auctioning companies' data on illegal online forums to try to pressure them into making payments, he said.

"We anticipate the actor to continue to attempt to extort victims," Larsen said. Snowflake, a cloud-based data analytics firm, said on June 2 that hackers had launched a "targeted" effort directed against Snowflake users that used single-factor authentication techniques. The company declined to comment on any specific customers.

"Snowflake"

[Chris Mattern]

Well, you can't say they didn't tell you about the durability of the storage they were selling you.

Hey

[The Cat]

How's that cheap new hire thing working out for you, huh? Havin' a little trouble are we?

Maybe next time you'll think twice before laying off all those IT people.

If you pay them

[hdyoung]

ANYTHING, you’re an idiot. If your data is stolen, it will be sold. Repeatedly. To any and every criminal organization willing to buy it. If you pay ransom, the criminals will take your money, chuckle, and then sell your data anyways.

If your data is stolen, you’ve already lost. Paying the criminals won’t fix it. Suck it up, take your lumps, and deal with the fallout. But writing a check to the criminals will simply cost you more money and mitigate exactly none of the damage.

Re:

[tlhIngan]

ANYTHING, youâ(TM)re an idiot. If your data is stolen, it will be sold. Repeatedly. To any and every criminal organization willing to buy it. If you pay ransom, the criminals will take your money, chuckle, and then sell your data anyways.

If your data is stolen, youâ(TM)ve already lost. Paying the criminals wonâ(TM)t fix it. Suck it up, take your lumps, and deal with the fallout. But writing a check to the criminals will simply cost you more money and mitigate exactly none of the damage.

Paymen

Re:

[ls671]

Of course, the other option is for the company to simply wait for the data to be released and then download the stolen data back.

Exactly what our company data recovery/backups plans stipulate we should do! Most efficient way to cope with the issue and save tons of money, thus making our products more competitive and successful! Why maintain a complex backup architecture when the hackers do it for you for free? Joke's on them!

Re: If you pay them

[hdyoung]

There are tons of cases where the criminals didnt even bother to release the data back, after the ransom was paid.