Bose reveals it suffered “a sophisticated cyber-attack that disrupted some of its systems” in the United States.
Ransomware attacks are the new normal. From laptop manufacturer Acer to Colonial, the largest fuel pipeline in the United States, no one is protected from this ever-growing threat. Its latest victim is The audio equipment manufacturer giant Bose.
Bose has confirmed that it was a victim of a ransomware attack and experience a data breach on 7 March 2021, which impacted its US systems.
The incident was revealed in a letter [PDF] the company last week sent to the Attorney General at the New Hampshire Consumer Protection Bureau in which its legal representative stated that Bose did experience a “sophisticated cyber-incident.”
SEE: Bose Headphones allegedly spying on users – Lawsuit Filed
The incident reportedly “resulted in the deployment of malware/ransomware across [its] environment.”
Evidence of Data Exfiltration Not Found
As soon as the attack was discovered, Bose launched the necessary incident response protocols, including activating its technical team to prevent further spread of the malware and strengthening its defenses against “unauthorized activity.”
In April, the company’s investigating team learned that hackers had stolen HR data related to six of its ex-New Hampshire employees and “threat actor interacted with a limited set of folders.”
The data included social security numbers, employee names, and compensation data. However, they didn’t find any evidence that the data was or wasn’t “successfully exfiltrated.
SEE: D.C. Police Department suffers ransomware attack
The company has contacted the FBI for further investigation.
In early March 2021, Bose experienced a sophisticated cyber-attack that disrupted some of our systems. Based on our investigation and forensic analysis, Bose determined, on April 29, 2021, that the perpetrator of the cyber-attack potentially accessed a small number of internal spreadsheets with administrative information maintained by our Human Resources department, the letter stated.
These files contained certain information pertaining to employees and former employees of Bose. We understand this may be of concern. At this time, through our ongoing monitoring activities and investigative work, we have no evidence that this information has been misused or disseminated by third parties, claimed the company.
The data elements affected by the cyber-attack include your name, Social Security Number, compensation information, and comparable HR-related information, Bose revealed.
Malicious Files were Used in the Attack
Bose has also confirmed that the attackers used malicious files in the attack, and they have blocked the malicious IPs and sites linked to the “threat actor.”
The company’s media relations director Joanne Berthiaume stated that Bose hadn’t fulfilled any ransom demand from the attackers.
