Cyberattack on Dustin Exposes Data of Major Clients
Dustin, a publicly listed Swedish IT supplier known for providing mobile phones, computers, and software, experienced a significant cyberattack in early September. The company has recently begun restoring its IT systems and customer portal following this serious incident.
The attack was executed by the same group, FulcrumSec, that previously targeted the Danish pharmaceutical company Novo Nordisk in June. According to the hackers, they have stolen approximately 6.2 terabytes of internal data from Dustin, which includes over 24.5 million lines of source code, 1,041 code libraries, infrastructure configurations, and more than a million customer identities from Dustin's customer portal. Additionally, the hackers accessed 500,000 work tasks and internal vulnerability reports.
Eva Ernfors, Dustin's head of communication, confirmed that the threat actor has published data and stated that their top priority is to analyze the leaked information and implement necessary measures. She emphasized that the company does not make payments to criminal actors.
Among the clients affected by the data leak are the Dutch police, Rabobank, Post Nord, and the Copenhagen Municipality. The hackers identified 43 active user accounts belonging to the municipality's staff within the compromised systems, including an employee from the finance department who was unaware of the incident.
The finance department of Copenhagen Municipality is currently in discussions with Dustin but has not yet determined the full extent of the breach. They assured that there has been no impact on IT operations and are taking security measures to prevent the leaked information from being exploited.
Criticism of Dustin's Negotiation Tactics
On their leak site, FulcrumSec criticized the incident response team that represented Dustin during negotiations, suggesting that it is the same firm that previously handled negotiations with Novo Nordisk, which reportedly broke down due to perceived deception. The hackers expressed their dissatisfaction with the negotiation process, stating that they offered Dustin the chance to change negotiation teams, which was declined.
The leaked data also indicates that the cybersecurity firm Truesec was responsible for monitoring threats for Dustin. The hackers identified 178 guest accounts in Dustin's Azure Active Directory and nine confidential advisory decks prepared by Truesec for Dustin's clients. They criticized Truesec for being present during the data theft.
In communication with Ingeniøren, the hackers indicated that their assumptions regarding the negotiation partner are based on behavioral patterns rather than concrete evidence. They expressed curiosity about the negotiations between Dustin and Truesec, suggesting it would be unwise for Dustin to hire a firm with a known history of mismanagement in similar situations.
Intelligence Reviewed
Thomas "Mannie" Wilkan, head of research and dark web intelligence at Lab-1, described FulcrumSec as one of the most dangerous hacker groups currently active. He noted that their communication style is casual, yet they are highly professional in their operations. Wilkan warned that the data leak poses significant risks for both Dustin and its clients, as it may contain access credentials that could be exploited by other criminal groups.
The implications of this breach are severe, particularly for Dustin, whose business relies on providing IT infrastructure. The leak could lead to substantial legal and financial liabilities, further complicating the situation for the company and its clients.
