Attack traced to two computers
OMA says the attack happened July 15 and affected a limited portion of its local network. The organization says its IT team quickly identified and isolated the affected systems.
Access was restored through a separate, secure network later that morning.
The ransomware group behind the attack, known as the Booba Project, claimed it breached OMA.
Cybersecurity expert warns of ransomware threat
Ron Vaughn, a cybersecurity consultant with EMSCO Solutions, says ransomware groups often target specific industries because they can be profitable.
“It’s typically not personal. They will target certain vertical markets because they can be the most lucrative,” Vaughn said.
Vaughn recently discovered the Booba Project had posted a claim that it breached OMA.
“This is a relatively new breach outfit. They started attacking people about a month ago,” Vaughn said.
The group claimed it obtained 10 gigabytes of data and threatened to release it publicly if a ransom was not paid.
“They said that they had exfiltrated 10 gigabytes of data and they were going to hold them for ransom for repayment, or they would release it out into the wild,” Vaughn said.
Vaughn says those threats should be taken seriously.
“It’s typically not an idle threat,” he said.
How businesses can protect themselves
Vaughn says businesses can take several steps to protect their networks, including using strong passwords, multifactor authentication and encryption.
“Strong password management is good, but multifactor and encryption are two of the best,” Vaughn said.
He also recommends employee training and phishing simulations because phishing attacks are a common way hackers gain access to networks.
OMA says client records were not compromised
OMA says it has found no evidence that information was removed from its systems or that client records were compromised. The organization says its client information is maintained on a separate system that was not involved in the incident.
OMA says it continues to work with IT professionals to review the attack and strengthen its existing security measures.
