A ransomware gang claiming responsibility for the Companies and Intellectual Property Commission hack says they’ve had access to the agency’s systems since 2021.
The attackers told MyBroadband that they got in using an exploit in a system developed for the CIPC by software development house Sword South Africa. “They tried to cover their tracks when we pointed out the basic security holes. They are reckless with sensitive info,” the group said.As proof of their claims, they provided private information MyBroadband would recognise.
Since the site is still vulnerable and live, we will not disclose any details about this exploit yet.After their initial ransomware attempt in 2021, the attackers said they moved on when it seemed like the CIPC had cut off their access to its systems. Skids is a contraction of “script kiddies” — a derogatory or self-deprecating term used amongst hackers to describe those with limited skills and only use programs or exploits developed by others.“This time we got access to unencrypted card data and didn’t dump it… Why? Because although we want money, we are not after the individuals but the bigger organisations!”“We do not have any affiliations or agenda besides finding entities corporations with embarrassingly poor security.