• Hi there and welcome to PC Help Forum (PCHF), a more effective way to get the Tech Support you need!
    We have Experts in all areas of Tech, including Malware Removal, Crash Fixing and BSOD's , Microsoft Windows, Computer DIY and PC Hardware, Networking, Gaming, Tablets and iPads, General and Specific Software Support and so much more.

    Why not Click Here To Sign Up and start enjoying great FREE Tech Support.

    This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

This ransomware steals your data and threatens to report you for a GDPR violation


PCHF Tech News
Jan 10, 2015
Cybercriminals are once again targeting unsecured MongoDB databases but this time they are threatening to report the owners of those database for GDPR violations if their ransom demands are not met.

As reported by ZDNet, the hacker behind this new campaign has uploaded ransom notes on 22,900 MongoDB databases that were left exposed online without a password. They are using an automated script to scan for misconfigured MongoDB databases, wiping them and then demanding that a ransom of 0.015 bitcoin or around $140 be paid.

The campaign was first discovered by security researcher Victor Gevers at the Dutch Institute for Vulnerability Disclosure back in April.

After leaving the ransom note, the attacker gives victims two days to pay before they contact a victim's local GDPR enforcement authority to report the data leak they caused in the first place.

GDPR violations

Once the attacker gains access to a victim's MongoDB server, they wipe the databases it contains and create a new database called “READ_ME_TO_RECOVER_YOUR_DATA”.

Inside the new database, there is a collection named “README” which contains a ransom note explaining the victim's data has been “backed up” and that they must pay $140 to recover it, which reads:

“After 48 hours expiration we will leaked and exposed all your data. In case of refusal to pay, we will contact the General Data Protection Regulation, GDPR and notify them that you store user data in an open form and is not safe. Under the rules of the law, you face a heavy fine or arrest and your base dump will be dropped from our server!”

Based on preliminary analysis conducted by Gevers, he believes that the data was actually not backed up before the database was wiped.

While cybercriminals have targeted unsecured database servers in the past, this is the first time that they've used the threat of a GDPR violation against their victims to ensure that their ransom is paid.

Via BleepingComputer

Continue reading...