A significant Indian lending organization ‘Fullerton India’ was breached at the beginning of April 2023. The LockBit ransomware Darknet blog, where hackers listed the business and have since released all the hacked information, confirms it.
According to reports, on May 3, 2023, the LockBit 3.0 ransomware group exposed more than 600 GB of crucial data belonging to Fullerton, India, and its clients on the dark web.
The hackers gave Fullerton India over a week to negotiate a ransom demand of Rs. 24 crores from them. The business declined to engage in negotiations with the hackers.
Information Disclosed on Dark Web
The released data include loan agreements with individuals and legal entities, the status of customer and organizational accounts, agreements with banks and other financial institutions, and data on international transfers.
Also, financial documents, including sales information and mail correspondence on important transactions with attachments. The personal data of the company’s customers, such as Aadhaar card numbers, their residential and property addresses, phone numbers, cheque numbers, and other sensitive information.
Along with the clients’ personally identifiable information (PII), other sensitive data has also been disclosed, including customer IDs, bank account numbers and the dates on which they were opened, Real Time Gross Settlement (RTGS) information, National Electronic Funds Transfer (NEFT) information, branch codes, and financial transactions, including withdrawals and deposits.
The company said that “Fullerton India has learnt that some unknown entities have claimed to publish company data on illicit websites. Fullerton India cannot confirm these assertions as it is investigating the issue. The company has engaged with global experts to examine the content of the data, allegedly pertaining to it and to significantly enhance its security environment”.
After the data breach was discovered on April 24, the NBFC major temporarily suspended operations.
LockBit 3.0 demanded a ransom of $29,999,99, or Rs. 24 crores, to erase the compromised data. The hackers also stated that the company could postpone the deadline for $1,000 every day.
