Cellcom targeted by SiegedSec in alleged customer support panel breach

• Ransomware group: SiegedSec
• Country: Israel
• Sector: Technology
• Announcement date: December 8, 2023

SiegedSec claims unauthorized access to Cellcom support systems

The ransomware group known as SiegedSec has announced a data breach involving the Israeli telecommunications provider Cellcom. According to an announcement made on a leak site on December 8, 2023, the group claims to have successfully gained unauthorized access to the company's customer support panel. This claim follows an alleged attack date of November 26, 2023.

The group's claims regarding the nature of the intrusion are specific. SiegedSec alleges that they were able to access the customer support panel of the organization. While the group claims to have accessed nearly 180,000 customer records and support tickets, they have stated that they were unable to exfiltrate customer data. However, the group further claims that they were able to alter support messages within the system.

Evidence provided by the group includes screenshots displaying system interface visuals and sample data in JSON format, which is claimed to be taken directly from the customer support panel. Despite these claims, information regarding the SiegedSec group remains limited, making it difficult to ascertain their full operational profile or typical methods.

Data and records involved in the alleged breach

The claims made by SiegedSec suggest that a significant volume of internal information was exposed through the compromised support interface. Although the group states they could not exfiltrate customer data, they claim to have accessed a large number of specific records. The following data types are identified as being affected according to the group's claims:

• Customer support records
• Support tickets

The group's claim regarding the volume of data involves approximately 180,000 records. It is important to note that no information was provided regarding the specific size of the data or a specific ransom demand.

About Cellcom

Cellcom is a leading telecommunications company based in Israel. The company provides a wide range of essential communication services, including mobile, landline, internet, and television services.

Analysis and implications for the telecommunications sector

This claim suggests that the institution's customer support infrastructure may have been vulnerable to security breaches. The claim of access to customer data could trigger legal processes regarding data privacy and protection. Furthermore, the claim that support messages were altered indicates that the institution's operational integrity and customer trust may be compromised.

In the broader context of cyber threats, such incidents highlight the risks associated with web-facing administrative interfaces. When attackers gain access to support panels, they can potentially manipulate communications, which undermines the reliability of the service provided to users. There may be a risk of recurring attacks or the potential sharing of obtained data on various platforms in the future.

For organizations within the technology and telecommunications sectors, these types of claims underscore the necessity of robust security postures. To mitigate such risks, organizations often need to review system access controls and implement necessary measures against potential data breaches. Common defensive strategies include implementing multi-factor authentication for all administrative panels, maintaining strict principle of least privilege for support staff, and continuous monitoring of system logs to detect unauthorized alterations to data or messages.

The mechanics of ransomware and data extortion

While the specific details of the SiegedSec demand are unknown, the nature of the claim aligns with common patterns seen in modern cyberattacks. Ransomware groups often utilize various methods to pressure organizations, and the claim of altering data or accessing support systems can be part of a broader extortion strategy. Organizations facing such threats must prioritize the integrity of their communication channels to ensure that customers are not misled by unauthorized message alterations.