The Development Bank of Southern Africa (DBSA) was subjected to a ransomware attack last month and believes its employees’ personal information has been accessed or acquired by unauthorised people.
In a note to staff on Monday, the DBSA said based on its preliminary investigations, it believed the “threat actor” was Akira, a Russian ransomware group. It said this was not definite as investigations were still ongoing. The attack happened on or about May 21.
“Various servers, log files and documents were encrypted by Akira who threatened to publish the information to the dark web if their demands (the payment of money) were not met.”
The DBSA said upon becoming aware of the incident it conducted an investigation and determined that categories of records of employees' personal information might have been accessed or acquired by the “threat actor”.
The bank said the personal information accessed could be limited to the names and surnames of employees.
“As our investigation into the incident is ongoing it is not clear the full extent to which the personal information was compromised.
“After our discovery of the incident, the DBSA appointed a forensic investigator who is assisting in investigating the extent of the incident.”
The bank is also searching the dark web to determine whether the information has been published.
The bank revoked third party access to its information systems to prevent further access.
TimesLIVE
Support independent journalism by subscribing to the Sunday Times. Just R20 for the first month.
DBSA suffers ransomware attack
The DBSA believes employees' personal information may have been accessed or acquired by unauthorised people
Image: 123RF/WELCOMIA
The Development Bank of Southern Africa (DBSA) was subjected to a ransomware attack last month and believes its employees’ personal information has been accessed or acquired by unauthorised people.
In a note to staff on Monday, the DBSA said based on its preliminary investigations, it believed the “threat actor” was Akira, a Russian ransomware group. It said this was not definite as investigations were still ongoing. The attack happened on or about May 21.
“Various servers, log files and documents were encrypted by Akira who threatened to publish the information to the dark web if their demands (the payment of money) were not met.”
The DBSA said upon becoming aware of the incident it conducted an investigation and determined that categories of records of employees' personal information might have been accessed or acquired by the “threat actor”.
The bank said the personal information accessed could be limited to the names and surnames of employees.
“As our investigation into the incident is ongoing it is not clear the full extent to which the personal information was compromised.
“After our discovery of the incident, the DBSA appointed a forensic investigator who is assisting in investigating the extent of the incident.”
The bank is also searching the dark web to determine whether the information has been published.
The bank revoked third party access to its information systems to prevent further access.
TimesLIVE
Support independent journalism by subscribing to the Sunday Times. Just R20 for the first month.
MORE:
AI set to spark new cybersecurity arms race
Showmax admits number of subscriber login details were hacked
Justice department loses millions in yet another cyber attack
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.
Most read
Latest Videos