E-mail ids of employees of Defence PSU, BEML were found to be hacked and internal data dumped on the darknet
E-mail ids of employees of Defence PSU, BEML were found to be hacked and internal data dumped on the darknet.
BEML
Bharat Earth Movers Limited (BEML) manufactures a variety of heavy equipment and operates under three major business verticals: mining & construction, defence and rail & Metro with its headquarters located in Bengaluru.
According to Cyble, a US-based cyber intelligence agency, the breach took place on May 25by a threat actor named R3dr0x. BEML said the Indian Computer Emergency Response Team (Cert-In) alerted it to the breach on June 3 and immediately formed a high-level committee to investigate the breach.
Data exposed
The attacker said that the files were downloaded from the email accounts of seven employees and a text file consisting of employees internal address and login passwords were leaked.
According to Cyble the data leak includes multiple BEML’s email conversations, customers detailed records, multiple interoffice memos, freight invoices and added screenshots of the data leak on Cyble blog.
“The compromised documents are non-classified and have no financial impact for the company nor will provide any benefit to the hackers,” said BEML.
“As an immediate measure we have deactivated the suspected e-mail ids, all computing devices used to access these emails have been quarantined from the business network, an internal analysis of logs have been carried out and data has been secured for further forensic Cyber Audit,” said a BEML spokesperson.
Cyble later clarified that R3dr0x wasn’t responsible for this leak; it was made by an unknown party.
After the actor logged into the email ids, the old passwords were changed into passwords like “GoToHellBJP!!1” and “FreeKashmir” which further led the company to suspect that it was a neighbouring country or a politically motivated leak.
“Based on the leak itself, it appears to be an act of a hacktivist or politically motivated. At this point we have no technical evidence suggesting that the attack originated from a neighbouring or non-friendly country; however, the circumstantial pieces (actor’s message, password combinations) suggests it to be likely the case,” the firm said.
For the latest cyber threats and the latest hacking news please follow us on Facebook, Linkedin, and Twitter.Y
You may be interested in reading: Private Zoom Video Recordings Exposed Online