Ransomed.vc, a ransomware group, asserts that it has successfully penetrated Sony Group and is issuing threats to sell a cache of data stolen from the Japanese company.
Although these claims lack verification, Cyber Security Connect (CSC) reports that this relatively new ransomware player “has racked up an impressive number of victims” since it emerged on the scene just last month.
The ransomware group claimed:
“We have successfully compromissed [sic] all of sony systems. We wont ransom them! we will sell the data. due to sony not wanting to pay. DATA IS FOR SALE,”.
“WE ARE SELLING IT”.
According to CSC, the group has published some evidence of their hacking activities, although they acknowledge that this evidence is “not particularly compelling information on the face of things.”
The evidence comprises what appear to be screenshots of an internal login page, an internal PowerPoint presentation, several Java files, and a file directory of the leak, which appears to contain fewer than 6,000 files.
The group has specified a “post date” of 28 September, indicating that if no one purchases the data by that time, Ransomed.vc will likely release the data in its entirety.
It is worth noting that Ransomed.vc is believed to operate as both a ransomware operator and a ransomware-as-a-service organisation.
The group claims not only to be a “secure solution for addressing data security vulnerabilities within companies”, but also to be operating “in strict compliance with GDPR and Data Privacy Laws”.
The group also said “In cases where payment is not received, we are obligated to report a Data Privacy Law violation to the GDPR agency!”.
At the time of writing, Sony has not acknowledged nor denied this incident.
Sony suffered a massive data breach in 2011
In 2011, Sony’s PlayStation Network (PSN) experienced a significant security breach, leading to the compromise of personal information from around 77 million user accounts and the suspension of the service for a period of 23 days.
Sony issued apologies not only to its gaming community but also to game developers whose releases were impacted or whose online services were rendered inaccessible due to the incident.
Subsequently, Sony found itself entangled in as many as 55 class action lawsuits and ultimately agreed to provide compensation to those affected, which included offering free games as part of the restitution process.
