A Russian hacker named m1x managed to hack into puebla.gob.mx, a Mexican government web portal for the city of Puebla, and stole information from it.
The hacker then asked the the Mexican government to pay up. Three days later, the hacker released the data of some 14,000 Mexican taxpayer ID numbers three days after the government failed to pay the ransom, according to researchers at Lucy Security.
Colin Bastable, the CEO of the security company, said that the researchers discovered the case on a hacking forum on the dark web on June 7.
The hackers leaked the information, simply because the Puebla government who dealt with it didn't know how to pay in Bitcoins.
For this reason, the two parties couldn't reach an agreement fast enough.
The leaked information included a 100GB of Mexican government data, put on a public cloud service.
“There appears to be a trove of credentials in the data,” Bastable said, who added that the taxpayer ID numbers included people's home addresses and phone numbers. The hacker also released a number of police records.
It should be noted that the hacker m1x changed its plan during the course.
At first, m1x gave the Mexican government five days to pay the ransom. Despite the person dealing with the case in Puebla didn't know how to pay the ransom, m1x released the data two days early.
“It’s not clear why he changed course, but’s what’s clear is that he rapidly accelerated the pressure on the victim, a tactic we’ve seen in several ransomware cases in the past several weeks,” explained Bastable. “Typically, these type of hackers will do a public auction, but in this case the data was up there for anyone to grab.”
“All Mexicans should be concerned,” Bastable said.
“Mexico is a dangerous place for police, journalists, politicians and most citizens – leaked data such as this exposes many people to physical danger as well as greater cyber risk.”
Government websites are alluring targets to hackers simply because they are responsible for sensitive data.
What's more, the websites often act as a portal that holds access to a massive trove of valuable information that could be sold to third-parties, or held ransom for a sum of money.
This is why government websites and applications need to be audited from a cyber security perspective before they are hosted and launched. The auditing of the websites and applications should be conducted on a regular basis even after they are up online.
Government should also have security auditing organizations its back to support and audit implementation of information security best practices.
This is essential since a higher number of targeted ransomware or malware attacks have happened in 2020, especially during the 'COVID-19' coronavirus pandemic, where an increasing number of people work and study through devices that connect to the internet.
Other government sectors that are alluring targets, include and not limited to: transportation, energy, defense, space, media and telecommunications sectors.
The hacker m1x that is said to be Russian, has been an active user of the original dark web hacking website since June 24, 2009.
Bastable said the primary motivator appears to be money. He theorizes that m1x may release more data later in the future.
