What’s at stake: Storm has listed five U.S. banks holding about $6.1 billion in assets, plus Insight Credit Union, and four of the banks have not publicly confirmed or denied an incident.Supporting data: Sawyer, a $285 million bank, notified 16,069 people that their names and Social Security numbers were taken, according to the Indiana attorney general’s breach report.Overview bullets generated by AI with editorial review.Processing ContentAttackers stole files holding the names and Social Security numbers of 16,069 people from a New York community bank this summer, and the ransomware group that claimed the attack has named five other U.S. financial institutions as victims in a recent wave of attacks.Sawyer Savings Bank in Saugerties, New York, closed all of its branches for a week in August. Days into the closure, a group calling itself Storm listed Sawyer on its leak site, where the gang names organizations it says it hit as a way of pressuring them to pay a ransom.One of the other institutions Storm listed, Insight Credit Union in Winter Springs, Florida, reported a data breach to the Texas and Vermont attorneys general in notices dated Friday.Storm has also claimed it hit Pioneer Bank in Albany, New York; The Cecilian Bank in Cecilia, Kentucky; First Secure Bank Group in Illinois; and The Poca Valley Bank in Walton, West Virginia.A listing on a leak site is a claim, and gangs sometimes overstate what they took or whom they hit.None of the four unconfirmed banks appears in the searchable breach records that six states publish: Texas, Vermont, California, Washington, Indiana or Massachusetts.None of the six financial institutions responded to requests for comment. Constangy, Brooks, Smith & Prophete, the law firm that filed the notice for Sawyer, also did not respond to a request for comment.The five banks and one credit union collectively hold about $6.7 billion in assets, according to call reports published by the Federal Deposit Insurance Corp. and National Credit Union Administration.The breach at Sawyer took place at a vendor the bank relied on rather than the bank itself. Sawyer’s New Hampshire filing said the incident happened inside the systems of its managed service provider, the outside firm that runs its IT.Storm’s leak site appears to belong to a group Microsoft tracks as Storm-1175, which Microsoft has said is likely exploiting a flaw in software those providers use to manage their clients’ computers.What Sawyer’s filings saySawyer Savings Bank “identified a network disruption resulting from a security incident within the environment of its managed service provider” on Aug. 3, according to the Oct. 9 notice the bank’s lawyers filed with the New Hampshire attorney general.The bank’s investigation found that “certain files were acquired by an unauthorized individual,” according to the notice. Sawyer finished reviewing those files on Sept. 21 and mailed letters to the affected people on Oct. 9.The files held names and Social Security numbers, according to the New Hampshire notice.There is “NO evidence that debit card numbers, financial account numbers,” or information in the bank’s core banking system (the software that keeps its account records) “were involved,” according to the letter to affected people attached to the New Hampshire notice.Sawyer’s breach affected 16,069 people in total, according to the list of breaches reported to Indiana’s attorney general, published by the state.None of the filings name the IT provider or say whether the attack involved ransomware, although Microsoft has said Storm-1175 deploys ransomware.”We believe this was the result of a vendor vulnerability,” James P. Whitaker, the bank’s president and CEO, said in an Aug. 6 update to customers while its branches were closed.Storm’s listStorm listed Sawyer on Aug. 7, according to an American Banker review of the listing at the time. It listed Pioneer the same day, then Cecilian on Aug. 23, Insight on Sept. 15 and Poca Valley on Sept. 30, according to ransomware.live, a site that tracks ransomware gangs’ leak sites.Storm listed First Secure Bank Group four times between Sept. 18 and Sept. 27, although it appears these separate listings each concern the same incident; one names the bank group, and the three others name each of the group’s three banks.Pioneer’s parent company, Pioneer Bancorp, has filed no report of a cybersecurity incident with the Securities and Exchange Commission.Insight’s breach involved Social Security numbers, driver’s license and other government ID numbers, and financial account and card numbers, according to the breach reports the Texas and Vermont attorneys general published.Neither report about Insight gave a cause, a date for the incident or a total number of affected individuals.The vendor linkStorm-1175 began deploying a new strain of ransomware called StormEncryptor on Aug. 2, according to an Aug. 7 post by Microsoft Threat Intelligence.The group is “likely exploiting” a flaw in N-central, software from the vendor N-able that IT providers use to monitor and manage their clients’ systems, the post said. Microsoft “has not confirmed” that, according to the post.The N-central flaw became public Aug. 2, the same day N-able released a fix and urged all customers to upgrade “ASAP,” according to the company’s status page.Storm’s leak site posted its first victims on Aug. 7, and ransomware.live estimates the earliest of those attacks happened Aug. 3. Sawyer identified the incident inside its IT provider’s system on Aug. 3.The leak site’s name and timing tie it to Storm-1175, but Microsoft’s post does not mention the site, and Sawyer’s filings do not name N-central.N-able took the hosted version of N-central offline worldwide Monday, after a security researcher published code he said exploits more than 30 previously unknown flaws in the software, BleepingComputer reported. Those are different flaws from the one Microsoft linked to Storm-1175, which N-able fixed in August.N-able told customers running N-central on their own servers to shut them down until it releases a fix, according to its status page.”At this time, we have no evidence that any customer environment has been successfully exploited,” N-able said on the page Tuesday about the latest round of flaws.
——————————————————–
Click Here For The Original Source.
