ALPHV ransomware group claims ITM solutions provider QSI as victim

Quality Service Installation (QSI), an internationally recognized ITM and ATM solutions provider, has allegedly fallen prey to a ransomware attack, according to a recent announcement by the BlackCat ransomware group.

QSI, Inc. is known for its extensive offerings in the financial sector, particularly as one of the largest financial resellers of NCR products, offering comprehensive bank equipment solutions.

However, the company has not officially confirmed the assertion of a cyberattack on QSI Banking. Instead, it has been reported by cybersecurity researchers who traced the information to a dark web announcement.

On October 14, 2023, hackers associated with the ALPHV ransomware group made their claims regarding the QSI Banking ransomware attack. Cybersecurity analyst Dominic Alvieri further publicized the incident on social media. Alvieri shared screenshots from the BlackCat/ALPHV ransomware group’s website detailing the QSI Banking attack.

In a tweet, Alvieri shared, "BlackCat posts QSI Banking, Inc. with an extensive list of affected banks. /qsibanking[.]com." As of the time of this report, QSI Banking’s website remained accessible.

The BlackCat group, responsible for the claim, declared that they had successfully exfiltrated a wide array of data from QSI. This data included financial records, client information, and work-related data. Additionally, personal data and development information were reportedly compromised. BlackCat asserted that they had managed to steal a substantial 5TB of SQL-based data from QSI.

Among the banks purportedly affected by the QSI Bank hacking are Wesbanco Bank, First Financial Bank, Stock Yards Bank & Trust Company, German American Bank, State Employees CU of Maryland (SECU), First Financial Bank, National Association, Union Savings Bank, National Cooperative Bank, Civista Bank, and Mvb Bank. The authenticity of this information is yet to be verified.