Australian iron ore giant Fortescue Metals said it suffered a significant data breach as a result of the Clop ransomware group exploiting a zero-day vulnerability in the MOVEit Transfer web application.
Fortescue Metals is the fourth-largest iron ore producer in the world, holding 87,000 square kilometres of ore-rich land in the Pilbara region of Western Australia. It has more than 11,000 employees worldwide and also mines gold, copper and lithium in multiple countries.
The Clop ransomware gang added nine more organisations to its list of MOVEit Transfer victims over the past week, including Fortescue Metals. As of today, more than 350 organisations worldwide have been impacted by the exploitation of vulnerabilities in the commercial file transfer software.
The ransomware group said it is in possession of confidential data stolen from Fortescue Metals, adding that the cyber attack was “only financial motivated” and that it “does not care anything about politics”.
The group, whose ransom demand isn’t known yet, hasn’t published the stolen data and has given the company another chance to meet its ransom demands. “The company doesn’t care about its customers, it ignored their security!!!” Clop added.
Acknowledging the ransomware group’s announcement, Fortescue Metals confirmed that on the 28th of May, it became a victim of a “low-impact cyber incident”. The company added that the data exfiltrated from its network “was not confidential in nature,” and that “a small portion of data” was stolen from its network.
“We notified the Australian Cyber Security Centre of the incident, and our internal investigation and remediation actions are now complete,” Fortescue said in a statement.
Last week, US-based population research service provider Pension Benefit Information said it suffered a massive data breach as a result of the Clop ransomware group exploiting a zero-day vulnerability in the MOVEit Transfer web application.
According to PBI’s internal investigation, the compromised information included clients’ names, partial mailing addresses, Social Security numbers, and dates of birth. The company clarified that this incident did not affect PBI’s “core systems or software”.
Initially, in a filing with the office of the Maine Attorney General, PBI said that 371,359 individuals were affected by the data security incident. The company later said in a separate filing with the US Department of Health and Human Services Office for Civil Rights that the incident impacted at least 1,209,825 individuals.
