Extortion in black gold country

A hacker using the name “Hacker Buba” recently attempted to extort money from Invest Bank, based in the United Arab Emirates.

The hacker demanded that the bank pay the equivalent in Bitcoins of USD 3 million in exchange for not selling or publishing client banking data that the hacker had stolen; he claimed to have some 900 GB of data, representing a considerable mass of information.

On 18 November, after the bank had refused to comply, the Twitter account “@hacked_invest” announced that it could sell databases containing the banking information, including payment card numbers.

 

blog23

Tweet by @hacked_invest

The hacker also (and this is atypical) contacted journalists to offer them a percentage of the ransom in exchange for their help in persuading the bank to comply with the ransom demand. Perhaps he thought that the resulting media pressure might force the bank to pay the ransom in order to protect its clients. No journalist, however, responded favourably to the request.

Thanks to an intervention by the bank, the Twitter account was suspended on 23 November. Seeking revenge, the hacker subsequently created 50 other accounts on which he published a link to another site, this time containing data from 40,000 client accounts.

The media continued to reveal the fallout from this affair and contacted persons named in the files published by Hacker Buba. These people were unaware that their personal data had leaked, and made their displeasure known.

The bank thus did not warn its clients, which caused considerable harm to the bank in terms of public image when the tale was related by articles in the press.

Extortion is a technique used increasingly frequently by hackers against public and private organisations, as well as private individuals. In addition to financial damage, the image of a company can be severely tarnished if communication and crisis management plans are not put in place before any attack. This means that it is important for public and private organisations to monitor the evolution of threats so as to be ready to react in an appropriate manner.

Suggestions