Courts Fined $178,000 Over Ransomware Attack Affecting One Million People
A ransomware breach affecting the personal information of close to one million individuals has resulted in a $178,000 penalty for home goods and electronics seller Courts has been fined $178,000, representing its third violation of data protection rules since January 2019. The September 2022 security incident impacted 946,972 individuals, which included 941,513 customers alongside 5,459 current, former, and prospective employees, according to a Personal Data Protection Commission decision dated August 11 and published on its website on October 26.
Disaster Recovery Servers Exposed to Internet
Hackers breached the Courts network around September 21, 2022, by targeting backup servers designed to maintain business operations if primary systems failed. Investigators found that two of these disaster recovery servers were accessible over the internet. The attacker scanned for vulnerable network entry points and repeatedly attempted access before securing system administrator login credentials through unknown means. Connections between those recovery servers and the broader network allowed the attacker to reach other systems. Ransomware was installed on 26 servers, fully or partially encrypting data on 20 servers.
Courts Isolates Servers After Receiving Ransom Demand
Malware was detected around September 26, 2022. A customer service employee subsequently received a ransom demand on October 1 seeking an unspecified payment in exchange for a password to recover the encrypted files. Courts did not respond, and no further contact from the attacker was reported. To address the breach, the company disconnected compromised machines, brought systems back online using uninfected backups, applied security patches, and restricted access permissions. Monitoring of the dark web and the internet for 12 months found no signs of public disclosure.
Regulatory Findings on Systemic Failures
The Personal Data Protection Commission found that Courts had failed to conduct security checks that could have uncovered and addressed the weaknesses exploited in the attack. Because backup machines were not regularly utilized for day-to-day business activities, the retailer omitted them from routine vulnerability scans under the assumption that they lacked criticality. Dismissing this argument, the commission pointed out that these machines served as a gateway to other network environments containing vast amounts of personal records. Dating back to July 6, 2022, the pair of internet-accessible recovery units had missed crucial updates, while numerous other machines operated on abandoned software platforms like Windows Server 2008, for which Microsoft terminated support in January 2020.
Regulator Issues Fine Following Two Previous Penalties
When calculating the financial penalty, the PDPC took into account the magnitude of the breach, the confidential nature of staff financial records, and the firm’s history of non-compliance despite two prior sanctions. In 2020, Courts incurred a $9,000 penalty after a defective hyperlink in a promotional email sent to 76,844 buyers permitted unauthorized access to another patron’s profile, while a $15,000 sanction was issued in January 2019 due to a website vulnerability that leaked telephone numbers and home addresses. In a statement, Courts accepted the decision and apologised to affected customers and staff. The enterprise noted that it had upgraded protective controls, hired cybersecurity experts to examine the event, and retained an outside agency to audit the impacted files. It also set up a support channel at [email protected].
Frequently Asked Questions About the Courts Data Breach
What specific types of employee data were compromised in the attack?
Among the most sensitive information affected were employees’ bank account details and information about their creditworthiness.
Did the breach expose customer credit card numbers?
The compromised records comprised names, identification numbers, addresses, contact numbers, and partial credit card details showing solely the final four digits for a portion of the database.
Were customers notified about the unauthorized access to their information?
Courts did not notify customers, assessing that their affected information was unlikely to cause significant harm.
Did investigators find proof that data left the company network?
There was no evidence that the affected data had been taken out of Courts’ systems, and monitoring of the dark web and internet for 12 months found no signs of public disclosure.