International AIDS Vaccine Initiative reveals INC ransomware attack on its systems

The International AIDS Vaccine Initiative said the data security incident it suffered last year compromised the sensitive personal information of its patients and staff.

 

Founded in 1994, the International AIDS Vaccine Initiative, or IAVI, is a global partnership that works to accelerate the development of vaccines to prevent HIV infection, AIDS, and other infectious diseases.

 

In a data security incident notice filed with the Office of Attorney General of Massachusetts and Vermont, IAVI said that on December 22, it identified unauthorised access to its internal network that caused operational disruptions.

 

The organisation immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. It also took steps to contain the incident, secure the affected network and notified relevant law enforcement authorities about the same.

 

“After an extensive manual document review of the data, we discovered your personal information may have been accessed or acquired by an unauthorised party between December 18, 2024 and December 22, 2024,” IAVI said in a letter to affected individuals. The compromised data included names and other personal identifiers of its patients and staff.

 

While IAVI found no evidence of the compromised information being misused, it has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.

 

It has also offered two years of complimentary identity protection and credit monitoring services through IDX to all affected individuals.

 

Recently, the infamous INC ransom ransomware group claimed responsibility for the cyber attack on IAVI and listed it as a victim on its data leak site. The group claimed to be in possession of confidential data stolen from the organisation and to prove authenticity of its claims, the group has also shared samples of the stolen data.