BlackCat ransomware gang claims major cyber attack on Western Digital, leaks stolen data

The notorious BlackCat ransomware gang has published screenshots of data allegedly stolen from the systems of data storage devices maker Western Digital on its data leak site.

California-based Western Digital, which manufactures and sells data tech products, including data storage devices, cloud storage services, and data center systems, suffered a cyber security incident on March 26 that involved threat actors gaining access to several of its internal systems.

The company later confirmed that the threat actors exfiltrated data from its systems, resulting in system disruption in certain parts of its business operations. While Western Digital did not disclose how the threat actors infiltrated its network or the type of data that was compromised, its statement implies that the incident was caused by ransomware.

The infamous BlackCat ransomware gang has claimed responsibility for the cyber attack on Western Digital and listed the company on its data leak site. According to cyber security researcher Dominic Alvieri, the ransomware group has posted screenshots of data allegedly stolen from the company during the cyber attack.

The post includes screenshots of video conferences and internal emails circulated within the company, including emails where the company officials discussed how to respond to the cyber attack. The post also includes a note for the company, where the threat actors have threatened to leak the stolen data periodically till they lose “interest” and then put it up for sale on the dark web.

The post also suggests that the threat actors are in possession of confidential company data such as code-signing certificates, firmware, personal information of Western Digital customers, and more. The threat actors also claimed to have access to the backup of the company’s SAP Back Office that dates to the last week of March.

Western Digital is yet to respond to the claims of the threat actors or confirm whether any ransom was demanded by the hacker group.