Bezeq targeted in data breach claim by SiegedSec

• Ransomware group: SiegedSec
• Country: Israel
• Sector: Technology
• Announcement date: December 8, 2023

SiegedSec claims breach of Bezeq customer database

The Israel-based telecommunications company Bezeq has been targeted in a data breach announcement published by the SiegedSec group. According to the claim made by the group on their leak site on December 8, 2023, the attackers have successfully compromised sensitive information belonging to the organization. The group alleges that the breach occurred around November 26, 2023.

The SiegedSec group claims to have published a customer database belonging to Bezeq on their dedicated leak site. The group alleges that they gained unauthorized access to the company's campaign management portal. Once inside, the attackers claim they utilized this access to send emails directly to customers. Furthermore, the group alleges they accessed a portal used for controlling infrastructure devices in Israel, and subsequently used that access to shut those devices down.

Details of the alleged data leak

The information released by the group allegedly contains approximately 50,000 customer records. The leaked data is said to include several categories of personally identifiable information. Based on the claims, the affected data types include:

• Full names
• Email addresses
• Phone numbers

The announcement included screenshots intended to support these claims, which featured visuals of campaign management panels and interfaces used for device control. No information was provided regarding the specific size of the data files or the specific ransom demand made by the group.

About Bezeq

Bezeq is Israel's largest telecommunications company. The organization provides a wide range of essential communication services, including fixed-line telephony, broadband internet, mobile telephony, and various data services.

Analysis and implications of the incident

This incident may increase the risk of phishing and social engineering attacks for Bezeq customers. When attackers gain access to contact information such as names, emails, and phone numbers, they can craft highly convincing messages to deceive individuals into revealing further sensitive information or downloading malicious software. Such tactics are common in modern cyberattacks where stolen data is used to build trust with the victim.

The unauthorized access to the company's campaign management panel could indicate potential vulnerabilities in the organization's internal system security. Furthermore, the alleged access to Israeli infrastructure devices may raise national security concerns and could lead to investigations under relevant regulations. Given the nature of the leaked data, the risks of double extortion or secondary attacks may be considered high. Double extortion is a tactic where threat actors not only encrypt an organization's data but also steal it, threatening to leak it publicly if a ransom is not paid, thereby increasing the pressure on the victim.

Information about the SiegedSec group remains limited. In the telecommunications sector, where organizations manage vast amounts of sensitive customer data and critical infrastructure, maintaining robust security protocols is vital. Organizations in this sector often focus on implementing multi-factor authentication, conducting regular security audits of management portals, and monitoring for unauthorized access to infrastructure control systems to mitigate such risks.