NewsBank listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: United States
• Sector: Education
• Announcement date: August 26, 2024

The Rhysida ransomware group has published an announcement on its dedicated leak site listing NewsBank, a provider of digital archives and databases. The group claims to have successfully obtained data belonging to the organization, marking a potential security incident for the institution.

The details of the claim

According to the announcement published on August 26, 2024, the Rhysida group has targeted NewsBank. In the listing, the threat actors claim to have acquired data from the organization. However, the group has not provided specific details regarding the scale of the operation. No ransom amount has been specified in the listing, and the group has not provided information regarding the total volume of data allegedly stolen.

Ransomware groups often use leak sites to pressure victims into paying ransoms by threatening to release sensitive information. This tactic is frequently referred to as double extortion. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage during negotiations. If the victim refuses to pay, the attackers threaten to publish the stolen information on public forums or sell it to other malicious actors.

Data involvement and specifics

At this stage, the specific nature of the compromised data remains unknown. The listing provided by the Rhysida group does not include any screenshots or specific examples of the files they claim to have stolen. Consequently, the exact contents and the scope of the breach cannot be determined from the available information. The listing names no specific data types.

About NewsBank

NewsBank is a digital archive and database provider that serves a wide range of clients, including libraries, schools, and universities worldwide. For over 50 years, the company has operated as a provider of reliable news and information resources. Their extensive archive includes a variety of newspapers, magazines, and other publications intended for educational and research purposes.

Analysis and potential implications

The Rhysida group has been known to target the education and public sectors since 2023. Because NewsBank operates within the education sector, this incident suggests that the data held by the institution, which could include information related to students or employees, may have been compromised. If a data breach has indeed occurred, the individuals whose information was stored by the organization may face various risks, such as identity theft or the threat of targeted phishing attacks.

Furthermore, as the organization is based in the United States, the incident may trigger legal processes under various federal or state-level data protection regulations. Organizations in the education and information services sectors often face significant regulatory scrutiny regarding how they protect the privacy of their users and subscribers.

To defend against such threats, organizations typically implement a multi-layered security approach. This includes maintaining robust backup solutions that are isolated from the main network to ensure data can be recovered without paying a ransom. Additionally, implementing strict access controls, continuous monitoring of network traffic, and regular security awareness training for employees are standard defensive measures to mitigate the risk of unauthorized access and data exfiltration.