Maze Ransomware Operators Leaked Public Data On Costa Rica Customers

[✨ Megiddo]

Edition Bleeping Computer reports that the hacker group behind cipher operations Maze, published on its website of credit card data, stolen from the Banco de Costa Rica. Since the bank’s management denies the fact of compromise, hackers are threatening that they will continue to publish such dumps every week until they are paid a ransom. In an interview with reporters, Maze operators noticed that they demanded a ransom from the bank several times, and, in theory, they could sell information about cards on the darknet.

As early as April 30, 2020, Maze operators announced that they had at their disposal the data of 11,000,000 cards issued by Banco de Costa Rica, approximately 4,000,000 of them are unique, and about 140,000 belong to US citizens.

Hackers claim that they first got access to the bank’s network back in August 2019, and then again, in February 2020, to “check if security has improved”. At the same time, for the second time, the attackers did not encrypt the files of the financial institution, since they considered that doing such during a pandemic was wrong and "the possible damage would be too great." However, the group did not leave the bank’s network empty-handed, having stolen the card data.

The now published 2GB dump contains Banco de Costa Rica payment card numbers. Hackers write that publishing this data in the public domain, they are not trying to capitalize on this, but they want to draw attention to the bank's security problems.

Screenshots of the contents of the database, showing unencrypted bank card numbers, were attached to the hackers message. In total, images contain data of at least 50 cards (some are listed several times). It is also worth noting that earlier Maze operators published more than 100 partial card numbers (the last four digits are deleted) with an expiration date and CVV codes.

Bleeping Computer researchers tested several cards through dedicated online services, and most passed the test. The bank identification number (BIN) showed that these are Visa and MasterCard debit cards, actually issued by Banco de Costa Rica.

Interestingly, representatives of Banco de Costa Rica stubbornly deny the fact of compromise. So, in early May, the bank issued an official statementaccording to which, after a thorough audit, representatives of Banco de Costa Rica were able to confirm that "the institution’s systems were not compromised."

At the end of last week, the bank made another statement, which again reported that numerous checks conducted by both the organization’s own specialists and invited experts showed that no one had access to the bank’s systems without authorization and “customer transactions were not affected.”

© https://xakep.ru/2020/05/26/maze-bcr/