The Russia-based ransomware syndicate Conti targeted Elgin County’s website and email system in a ransomware attack.
The group apparently posted one 40 megabyte ZIP file labeled “elgin_AccountsPayable containing information related to its residents on their dark web portal that they claim is only 10% of the stolen data from the county.
The county informed its resident of the attack and its IT team worked hard to restore functionality and systems.
Source: https://cjoy.com/news/8788980/elgin-county-data-ransomeware-crime/
TPRM report: https://scoringcyber.rankiteo.com/company/elgincounty
"id": "cou113925522",
"linkid": "elgincounty",
"type": "Ransomware",
"date": "04/2022",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of a geographical region"{'affected_entities': [{'industry': 'Public Sector',
'location': 'Elgin County',
'name': 'Elgin County',
'type': 'Government'}],
'attack_vector': 'Website and Email System',
'data_breach': {'data_exfiltration': 'Yes',
'file_types_exposed': 'ZIP',
'type_of_data_compromised': 'Resident Information'},
'description': 'The Russia-based ransomware syndicate Conti targeted Elgin '
'County’s website and email system in a ransomware attack. The '
'group posted a 40 megabyte ZIP file labeled '
"'elgin_AccountsPayable' containing information related to its "
'residents on their dark web portal, claiming it is only 10% '
'of the stolen data from the county. The county informed its '
'residents of the attack and its IT team worked hard to '
'restore functionality and systems.',
'impact': {'data_compromised': ['Resident Information'],
'systems_affected': ['Website', 'Email System']},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes'},
'motivation': 'Financial Gain',
'ransomware': {'data_exfiltration': 'Yes', 'ransomware_strain': 'Conti'},
'response': {'communication_strategy': 'Informed residents of the attack',
'recovery_measures': 'Restored functionality and systems'},
'threat_actor': 'Conti',
'title': 'Ransomware Attack on Elgin County',
'type': 'Ransomware'}