Some of the biggest US hedge funds and law firms have been targeted by a highly sophisticated data breach and extortion campaign, conducted by a group of criminals previously known as BlackFile, experts have warned.
BlackFile (or Redact, as the group is now calling itself) has a relatively simple modus operandi, also used by ShinyHunters – they call their targets on the phone (usually employees with access to SaaS systems), identify as IT staff, and direct victims to convincing, lookalike login pages designed to steal their credentials and authentication tokens.
Once they gain access to victims’ accounts, the attackers access enterprise SaaS environments (for example, Microsoft 365 and Okta) and use automated tools to exfiltrate sensitive data. In the last step, they notify the victims and threaten to leak the data on the dark web unless a ransom is paid.
Read more…
Source: Tech Radar News
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- X gets $140 million EU fine for breaching content rules but TikTok settles
December 5, 2025
Elon Musk’s social media company X was fined 120 million euros ($140 million) by EU tech regulators on Friday for breaching online content rules, the first sanction under landmark legislation that once again drew criticism from the U.S. government. While X did not respond to an emailed request for comment, Musk replied “Bullshit” under a European ...
- Trump’s national security strategy wants spy agencies to watch world supply chains
December 5, 2025
President Donald Trump’s national security strategy tasks the U.S. intelligence community with monitoring global supply chains as part of a sweeping goal to decouple the nation’s economy from foreign adversaries and advance American economic interests. The demands listed in the 33-page strategy document published late Thursday reflect how aggressively the Trump administration is directing federal agencies ...
- Fintech firm Marquis alerts dozens of US banks and credit unions of a data breach after ransomware attack
December 3, 2025
Fintech company Marquis is notifying dozens of U.S. banks and credit unions that they had customer data stolen in a cyberattack earlier this year. Details of the cyberattack emerged this week after Marquis filed data breach notices with several U.S. states confirming its August 14 incident as a ransomware attack. Texas-based Marquis is a marketing and compliance ...
- FTC cracks down on education tech company after massive student data breach
December 1, 2025
The Federal Trade Commission took action against Illuminate Education on December 1, 2025, after the Wisconsin-based company suffered a massive data breach that exposed personal information of more than 10 million students. In late December 2021, a hacker used login credentials from a former employee who had left the company three and a half years ...
- Bug in jury systems used by several US states exposed sensitive personal data
November 26, 2025
Several public websites designed to allow courts across the United States and Canada to manage the personal information of potential jurors had a simple security flaw that easily exposed their sensitive data, including names and home addresses, TechCrunch has exclusively learned. A security researcher, who asked not to be named for this story, contacted TechCrunch with ...
- US banks scramble to assess data theft after hackers breach financial tech firm
November 24, 2025
Several U.S. banking giants and mortgage lenders are reportedly scrambling to assess how much of their customers’ data was stolen during a cyberattack on a New York financial technology company earlier this month. SitusAMC, which provides technology for over a thousand commercial and real estate financiers, confirmed in a statement over the weekend that it had ...