There is no organization, whether public or private, that is safe from cyberattacks. This time, a team of web application security experts reported on a ransomware attack that has compromised the systems of PerCSoft, an information backup services company based in Wisconsin.
Among the company’s top customers is Digital Dental Record (DDR) which operates an online data backup service called DDS Safe, where medical records, insurance information, clinical histories and other data gathered by hundreds of dental offices throughout the U.S. territory.
Although the number of dental practices affected is still unknown, web application security experts say that not all practices that depend on DDS Safe have been compromised. The incident would have occurred last Monday and was detected almost immediately after the encryption of the information.
The company has not issued official statements about the incident, but a Wisconsin government official mentioned that the incident, a ransomware attack, encrypted the files of nearly 500 dental offices in the state, also adding that it has already been retrieved the information from about 100 of the company’s customers. “We still don’t know if the company decided to pay the ransom, neither the amount demanded by hackers; the malware variant used in this attack has also not been identified,” she said.
Thanks to the most recent posts on the company’s Facebook page, web application security experts discovered some details about the incident recovery process, mentioning that both PerCSoft and DDR hired services of a security company that is working on recovering files encrypted by the ransomware.
However, conflicting versions continue to appear, as some users in Facebook groups dedicated to cybersecurity claim that the company decided to pay the ransom to restore access to the compromised information as soon as possible. In addition, a supposed conversation between one of the affected practices and a PerCSoft executive leaked; in the chat, the executive is informing the client about their decision to pay the ransom. In the conversation, dental offices managers are concerned about having to cover the costs of the incident, to which the company executive answers: “We will pay the ransom.”
In more detail, a leaked screenshot of one of the infected machines shows that the malware employed by the operators of this attack is a newly detected and highly dangerous variant known as REvil or Sodinokibi. An official confirmation from the company is still expected.
Web application security experts collaborating in organizations such as the FBI and the International Institute of Cyber Security (IICS) advise victims of these attacks not to give in to the demands or threats of hackers, as this only benefits them and the risk of losing compromised information remains latent. However, an increase in the number of victims who decide to pay the ransom has been detected, as they are looking for quickly restore their operations and avoid a potentially long and costly data recovery process.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
