HTC Global Services confirms cyberattack; Data leak sparks concern

IT services and consulting firm HTC Global Services has acknowledged a recent cyberattack following the emergence of screenshots of compromised data by the ALPHV ransomware group.

 

The company, specializing in technology and business solutions across healthcare, automotive, manufacturing, and finance sectors, verified the incident. Although HTC has not released an official statement on its website, a brief confirmation was posted on the company’s X platform last night.

 

A tweet from HTC’s X account stated, "HTC has experienced a cybersecurity incident. Our team is actively investigating and addressing the situation to safeguard user data. We’ve engaged cybersecurity experts and are actively resolving this. Your trust is our priority."

 

This revelation coincides with ALPHV’s disclosure of HTC on their data leak platform, sharing screenshots allegedly containing stolen passports, contact details, emails, and sensitive documents purportedly obtained during the breach.

 

Cybersecurity analyst Kevin Beaumont suspects the breach might have exploited the Citrix Bleed vulnerability. Beaumont highlights that a susceptible Citrix Netscaler device within HTC’s CareTech unit could have facilitated initial network access for the attackers.

 

Despite attempts to reach HTC Global Services for comments on the nature of the attack and its potential Citrix Bleed involvement, there has been no immediate response to inquiries from the media.

 

The ALPHV ransomware group, formerly known as DarkSide and BlackMatter, garnered notoriety after targeting high-profile entities, notably gaining global attention following the Colonial Pipeline breach. The group’s modus operandi has evolved, with a recent surge in attacks targeting enterprises and adapting their tactics. The rebranded group has been associated with English-speaking threat actors who utilize their infrastructure for extortion attacks. Recent incidents include an attack on MGM Resorts by affiliates, encryption of over 100 ESXi hypervisors, and claims of data theft from Tipalti with extortion attempts on impacted entities.