HQ/EMEAFind out how we can help your business
One of the world’s biggest luxury boat and yacht retailers, MarineMax, notifies more than 120,000 people about a recent data breach incident on its system. Based on reports, the affected individuals’ personal information was compromised last March, which was then claimed by the Rhysida ransomware group.
This Florida-based yacht retailer initially revealed in its March SEC filing that no sensitive information was exposed in its system. However, it retracted its statement in its 8-k filing by disclosing that the attackers obtained personal information from an undisclosed number of persons.
Additionally, the company confirmed earlier this week, in breach notification letters submitted with the Attorneys General’s offices in Maine and Vermont, that the number of individuals it confirmed to be affected by the data breach reached 123,494.
It also noted in the filing that they discovered the breach ten days after the attackers acquired initial access to its network and that it affected only a “limited” number of systems.
MarineMax concluded that the attack’s perpetrators had stayed within its system for over a week.
The unauthorised access within MarineMax has persisted in the environment between March 1, 2024, and March 10, 2024. The investigation also discovered that the malicious third party obtained some of their data, including customer personal information.
MarineMax also informed the Maine and Vermont Attorneys General that the attackers had exfiltrated names and other personal identifying information. Still, it has yet to reveal what other personal information was stolen from its servers or whether the data hack affected both clients and employees.
On the other hand, the Rhysida ransomware group claimed responsibility for the attack despite the corporation not linking the hack to a threat group and continuing to refer to it as a “cybersecurity incident.”
The ransomware group published a 225GB bundle of files it allegedly stole from MarineMax’s network on their dark web leak site to prove their claims. However, the attackers explicitly noted that the displayed material was not for sale.
Rhysida shared screenshots of MarineMax’s financial paperwork, client and employee driver’s licenses, and passports. Therefore, these potentially affected individuals in the link should be vigilant as they can be subject to targeted cybercriminal campaigns.
