Hackers Claim Breach Of Financial Software Giant Wolters Kluwer, Data Allegedly For Sale
A threat actor has surfaced on a prominent cybercrime forum, claiming responsibility for a significant data breach involving Wolters Kluwer, a Dutch multinational that generates nearly US$7 billion annually by providing software and services to financial institutions, legal professionals, and major corporations around the globe.
The actor is offering a dataset they allege was exfiltrated from Wolters Kluwer’s systems, describing it as a fresh and exclusive leak. The dataset, reportedly ranging between 3GB and 6GB, is being auctioned with a starting price of US$15,000, and the seller claims it will be sold to only one buyer.
Cybersecurity researchers who reviewed samples of the data have expressed concern over the nature of the information exposed. According to analysis from Cybernews, the dataset includes full names, email addresses, phone numbers, residential addresses, job and academic information, and even social media handles and access tokens. While the dump does not include passwords, experts warn that the data is far from benign.
“This kind of data can fuel highly personalized phishing campaigns and impersonation attempts,” Cybernews researchers stated. “To some extent, threat actors could use data for identity impersonation and try to hijack victims’ accounts.”
The danger, experts say, lies in the potential for social engineering attacks. Detailed personal data could allow cybercriminals to convincingly pose as company executives or customer service representatives, or send fraudulent communications tailored to deceive victims into sharing further sensitive information or credentials.
Wolters Kluwer acknowledged the situation in a statement, confirming that it is investigating the matter. “We are aware of this matter and investigating any potential data impact,” the company said. “Our investigation is ongoing; based on our preliminary review to date, it appears the data is limited to business contact information in our health journals business. At this time, there is no evidence that any financial or tax data has been impacted, nor evidence of data impact associated with products outside of the health journals business.”
Despite this preliminary assessment, the company’s clients span a wide range of high-profile industries, including aviation, energy, and finance. Notable customers include British Airways, Emirates, American Airlines, Boeing, Rolls-Royce, and BP—raising concerns about the potential breadth of the breach’s impact if the claims prove accurate.
This is not the first time Wolters Kluwer has faced cybersecurity issues. In 2019, the company experienced a malware attack that disrupted client access to key databases, including those used to manage tax returns. That incident led to heightened scrutiny over the security of sensitive financial and tax information stored on the company’s cloud-based platforms.
