NSW Transport agency extorted by ransomware gang after Accellion attack

The transport system for the Australian state of New South Wales has suffered a data breach after the Clop ransomware exploited a vulnerability to steal files.

Transport for NSW is New South Wales' transport system in charge of the buses, ferries, regional air operators, and cargo transportation.

Last week, Transport for NSW disclosed that their agency suffered a data breach after their secure file-sharing system, Accellion FTA, was attacked and hackers stole data.

The agency is currently investigating the breach to determine what data was stolen and is receiving help from Cyber Security NSW, the New South Wales government information security team.

"Cyber Security NSW is managing the NSW Government investigation with the help of forensic specialists."

"We are working closely with Cyber Security NSW to understand the impact of the breach, including to customer data," Transport for NSW disclosed in a data breach notification.

Data leaked on Clop ransomware site

In December, threat actors began using a zero-day vulnerability in the Accellion FTA secure file sharing application to download and steal data.

Accellion FTA is commonly used by government agencies, educational instructions, and organizations to share files with people external to their organization securely.

After the Clop ransomware gang began leaking data stolen during these attacks and ransoming victims, it became clear that the ransomware group was behind the attacks. A report by Mandiant further confirmed the connection after analysis found shared IOCs between the attacks and the ransomware group.

This weekend, the Clop ransomware published screenshots of alleged emails and documents stolen from the NSW government during an attack on their Accellion FTA device.

In a message on the data leak site, the ransomware gang states that Transport for NSW or other interested parties can make a payment to prevent the leak or buy the stolen data.

"Want to delete a page or buy data? write to the email indicated on the home page," the Clop gang states on the data leak site.

The leaked data includes confidential documents, steering committee documents, and assorted emails.

Unfortunately, due to the popularity of the Accellion FTA service and the wide-scale attacks performed by the Clop ransomware gang, we should expect to see further leaks published in the future.

Other Accellion FTA victims recently disclosed by the Clop ransomware gang include mobile carrier Singtel, geo-data specialist Fugro, law firm Jones Day, science and technology company Danaher, and technical services company ABS Group.

Thx to Kay Kyoung-ju Kwak for the tip.