Acuity Brands admitted that they suffered data breaches

The well-known lighting and building management company Acuity Brands has publicly confirmed that they have suffered several data breach attacks in recent years. One of the attacks might have allegedly been a ransomware attack.

This firm from the state of Georgia in the US is home to nearly 13,000 workers and operates in multiple continents like Europe, Asia, and the Americas.

Acuity Brands disclosed that their company became aware of unauthorised access to their systems and data theft in December last year. The investigation of last year’s incident has revealed another unrelated data breach that occurred in October two years ago.

Unfortunately, both security incidents showed that the firm’s information affected the current and former personnel and Acuity Brand’s health plan members. Currently, there is zero proof that both data breach incidents also impacted customer information.

The breach has stolen troves of data such as Acuity plan information, driver’s license number, Social Security number, limited health information, financial account information, and other details related to employment.

 

Acuity Brands did not include any ransomware attack in its announcement.

 

The security notice of Acuity Brands did not mention any ransomware attack against their company. Still, researchers found evidence that the Conti ransomware group might have attacked them.

Experts said that the Conti leak website is not accessible anymore. Still, Red Packet Security’s ransomware website showed that the group may have leaked some information allegedly stolen from Acuity Brands last January.

The file names of the stolen data suggest that the stolen information is related to finances and HR and was published by the threat actors.

It has been a year since the Conti ransomware group listed Acuity Brands in its data leak website. However, the firm has only informed its partners, customer, and other individuals regarding the data breach last year. Acuity Brands has yet to provide notifications regarding the possible ransomware attack against their company.

This Atlanta-based company may face legal action because of its past security incidents. As of now, they are encouraging all impacted individuals to get in touch with their firm.