Ubiquiti confirms extortion attempt following security breach

Networking device maker Ubiquiti has confirmed that it was the target of an extortion attempt following a January security breach, as revealed by a whistleblower earlier this week.

The company, however, didn’t confirm the whistleblower’s claims that user data was accessed during the incident or that the attackers stole any Ubiquiti source code.

Ubiquiti added that incident response experts hired to investigate the breach didn’t find evidence of customer information being targeted during the breach.

“These experts identified no evidence that customer information was accessed, or even targeted,” Ubiquiti said in a statement.

“The attacker, who unsuccessfully attempted to extort the company by threatening to release stolen source code and specific IT credentials, never claimed to have accessed any customer information.

“This, along with other evidence, is why we believe that customer data was not the target of, or otherwise accessed in connection with, the incident.”

Ubiquiti is cooperating with law enforcement in an ongoing investigation of the incident, which has revealed that the attacker “is an individual with intricate knowledge” of Ubiquiti’s cloud infrastructure.

Although no proof that customer info was accessed, the networking device vendor advises customers to reset passwords and enable two-factor authentication on their accounts.

“All this said, as a precaution, we still encourage you to change your password if you have not already done so, including on any website where you use the same user ID or password,” the company said.

Whistleblower’s take on Ubiquiti breach

Ubiquiti told customers after the January security incident that the attacker compromised systems hosted at a third-party cloud provider with no indication that users’ accounts were affected in any way.

However, earlier this week, a whistleblower involved in the breach response challenged the company’s story, saying that the incident’s actual impact was massive.

Ubiquiti allegedly discovered the incident in December 2020 after the hacker already gained admin level to the company AWS accounts and databases stored on AWS.

After removing a backdoor used by the attacker in January, the hacker tried to extort the networking device vendor asking for 50 bitcoins not to reveal the breach, saying that he already stole Ubiquiti source code.

As the whistleblower also revealed, Ubiquiti did not have a logging system setup which meant that they could not check what data or systems the attacker accessed.

The company refused to pay the ransom and, instead, found and removed a second backdoor from its systems, changed all employee credentials, and issued the January 11 security breach notification.

As it stands, from all the info surrounding the breach exposed by the whistleblower, Ubiquiti has only confirmed the hacker’s extortion attempt.

Claims that source code was stolen and customers’ information was accessed during the breach are yet to be confirmed.

Ubiquiti shares have fallen from $349 on March 30 to $290 on April 1, after the whistleblower accused the company of downplaying the breach.

Source: https://www.bleepingcomputer.com/news/security/ubiquiti-confirms-extortion-attempt-following-security-breach/