Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 28-Dec-2024 21:04:58 JST Kevin Beaumont

   Space Bears ransomware group are claiming they have breached Atos Business Services France aka Atos SE, aka Eviden, aka the businesses formerly known as Appcentrica, Cloudreach, Edifixio, Engage ESM, Maven Wave, Syntel and Visual BI.

   #ransomware #threatintel

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Sunday, 29-Dec-2024 09:36:02 JST Kevin Beaumont

     in reply to

     Statement from ATOS, they say they are basically unaware of a security incident their end. https://atos.net/en/2024/news_2024_12_29/security-statement-2 #ransomware #threatintel

   • Embed this notice
     ClaireV (clairev@piaille.fr)'s status on Sunday, 29-Dec-2024 22:57:33 JST ClaireV

     in reply to

     @GossiTheDog where can we find the claim from Space Bears regarding Atos?

   • Embed this notice
     FL | エフル (fl@infosec.exchange)'s status on Sunday, 29-Dec-2024 22:59:25 JST FL | エフル

     in reply to

     @GossiTheDog "The Space Bears claim makes no reference to a database" ...Actually, it does

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 30-Dec-2024 07:44:59 JST Kevin Beaumont

     in reply to

     • RansomLook

     So Atos got the "company database" element from the updated Space Bears post - since the original post (as captured by @Ransomlook) they added a file list bit.

     Generally speaking, Space Bears are quite descriptive about what they've taken - which they haven't been here.

     #ransomware #threatintel

   • Embed this notice
     Graham Sutherland / Polynomial (gsuberland@chaos.social)'s status on Monday, 30-Dec-2024 07:49:01 JST Graham Sutherland / Polynomial

     in reply to

     • RansomLook

     @GossiTheDog @Ransomlook you reckon they aren't sure what specific data they pulled? or is there a different explanation?

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 03-Jan-2025 17:34:48 JST Kevin Beaumont

     in reply to

     ATOS are saying Space Bears definitely didn’t compromise them: https://atos.net/en/2025/press-release_2025_01_03/atos-confirms-not-being-compromised-by-the-ransomware-group-space-bears

     Space Bears still have a count down for 4 days.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 08-Jan-2025 19:49:28 JST Kevin Beaumont

     in reply to

     Space Bears changed their ATOS page to say "SOLD", which feels like it's not true given they never provided proof.

     With prior victims they provided download links which had legit data, so they've damaged their reputation over this one.

     #threatintel #ransomware