Ransomware Attack on IdeaLab compromises sensitive employee data

IdeaLab, an American technology startup incubator, said the data security incident it suffered last year compromised the sensitive personal data of its employees. 

 

Founded in 1996 and headquartered in Pasadena, California, Idealab is an accelerator and technology startup incubator that has launched more than 150 companies, including GoTo.com, CitySeach, eToys, Authy, and more.

 

In a data security incident notice filed with the Office of Maine Attorney General, IdeaLab said that on October 7, it identified suspicious activity within its digital network. The company immediately launched an investigation, with assistance from external service, security experts, to determine the nature and scope of the incident.

 

IdeaLab also took steps to secure the affected systems and notified relevant law, enforcement authorities, including the FBI about the incident

 

“The investigation determined that an unknown actor acquired certain data without authorisation on or about October 4, 2024,” IdeaLab said.

 

The compromised data included names and other personal identifiers including Social Security Numbers. The filing with the Maine state regulator also states that the company has identified at least 2,790 current and former employees impacted by the incident.

 

IdeaLab has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered two years of complimentary identity protection and credit monitoring services through IDX to all affected individuals.

 

 

In October, the Hunters International ransomware group claimed responsibility for the cyberattack on IdeaLab, listing it as a victim on its data leak site. The group said that it is in  possession of 262.8 GB of confidential organisational data and threatened to publish it if its ransom demands were not met.

 

On October 23, the hacker group published the stolen data from IdeaLab, indicating a failed ransom negotiation.