Online photography service Shutterfly suffered a Conti ransomware attack which allegedly compromised corporate data and encrypted thousands of devices. The ransomware group claims to have encrypted over 4,000 devices and 120 VMware ESXi servers. Reports from BleepingComputer believe the organization is currently in negotiations with the ransomware gang. The gang is using the common double extortion tactic threatening to leak Shutterfly’s stolen data if the company does not pay. A representative from Shutterfly made a statement confirming a ransomware attack that affected their Lifetouch and BorrowLenses business, Groovebook, manufacturing and corporate systems, but said that the Shutterfly.com website and customers’ financial information was not compromised. They stated they are still investigating the incident to assess the full scope of the attack.
Analyst Notes
Ransomware attacks are expected to continue to rise in 2022, organizations should have a quality Endpoint Detection and Response (EDR) solution and a SOC to triage alerts or a managed security service like Binary Defense to triage alerts. Organizations should focus on defense, prevention, and detection measures to keep ransomware threats off their networks, use the following preventative measures to protect from an attack:
- Implement network segmentation.
- Install updates/patch operating systems, software, and firmware as soon as practical after they are released.
- Implement monitoring of security events on employee workstations and servers, with a 24/7 Security Operations Center to detect threats and respond quickly.
- Use multi-factor authentication where possible.
- Use strong passwords and regularly change passwords to network systems and accounts, implementing the shortest acceptable timeframe for password changes.
- Avoid reusing passwords for multiple accounts.
- Focus on cyber security awareness and training.
- Regularly provide users with training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.
