CannonDesign data breach allegedly caused by Avos Locker

CannonDesign has rolled out notification letters to over 13,000 current and former employees to warn them about a data breach attack. The alert revealed that the hackers breached and stole data from its network last year.

The affected entity is a multi-award-winning architectural, engineering, and consulting firm established in the United States. It is also known for its work on meaningful projects such as academic buildings, hospitals, and sports arenas.

 

CannonDesign revealed that the data breach incident occurred in January last year, endangering relevant individuals for over 12 months.

 

CannonDesign began distributing notification letters to impacted persons informing them of a security issue between January 19 and 25, 2023. The company explained that the attack involved illegal network access and data exfiltration.

Although the company discovered the breach in January 2023, the investigation was concluded on May 3, 2024. The research indicated that the threat actor responsible for the incident may have accessed sensitive data, such as names, addresses, social security numbers (SSNs), and driver’s license numbers.

Hence, the company urged the recipients of the notification letters to enrol in their free two-year credit monitoring server. However, this offer is only limited to the risk associated with their personal data exposure.

CannonDesign has not identified the cybercriminals responsible for the assault. However, researchers suspect the disclosure is related to the Avos Locker ransomware attack that occurred early in 2023.

Furthermore, the company claims that it is unaware of any attempted exploitation of the stolen data, even though the stolen information has been published online several times and on several data leak sites.

On the other hand, the Avos Locker ransomware gang has already claimed responsibility for the malicious campaign on February 2, 2023. The group revealed it had stolen about 5.7 TB of data, including corporate and client files.

However, these threat actors allegedly failed to extort the architectural firm, which forced them to leak the data to another platform called Dunghill Leaks. On September 26, 2023, the attackers released another 2TB of purported data from CannonDesign.

The confirmed data in the leak include database dumps, project schematics, hiring paperwork, client information, marketing materials, IT and infrastructure specifications, and quality assurance reports.

As of now, CannonDesign has yet to address this new leak and has not confirmed the legitimacy of the exposed information. Potentially affected individuals should be cautious with their digital presence, as other threat actors could have already obtained sensitive information.