A group calling itself Barracuda claims to have stolen 2.44 TB of data from the main contractor on the Femern construction project, Femern Link Contractors (FLC), and to have had access to confidential files since 17 September.
The group claims to have copied more than 1.57 million files from the systems. It states this in a post about FLC on its website, where it is seeking a buyer for the material and lists a price of 500,000 dollars.
On 27 October, Femern A/S stated that FLC had informed the company that data, including personal data, had been stolen in connection with the cyberattack on 11 October. The statement specifies neither the scale nor exactly what information was taken.
On 28 October, cybersecurity company Brandefense recorded the post about FLC on Barracuda's leak site and also reports the claim of access since September.
However, neither the group's responsibility, the volume of data nor the duration of the access has been confirmed in the public statements from FLC and Femern A/S.
Digital traces must provide answers
In its own public statement, FLC writes that systems containing personal data have been “affected”.
This may cover several different circumstances, explains Sofie Freja Christensen, Consulting Manager, Cyber Risk & Offensive Security at Conscia.
– “Affected” can mean anything from the systems being locked to data being copied out and put up for sale. This can only be determined through forensic analysis of logs and network traffic, and it typically takes weeks. However, Femern A/S has already confirmed that data has been stolen. So the question is no longer whether, but what and about whom, she says.
She further explains that such an analysis examines the digital traces left by the attack. Among other things, experts can look at which accounts have opened specific folders and whether large volumes of data have been sent out of the company’s network. The traces can therefore help establish which information has actually been copied.
Employee information may be affected
According to Folketidende, an internal employee notice states that payroll and tax information, bank details, identity documents and health information may potentially be affected.
In its public statement of 27 October, FLC states that potentially affected employees have been informed and given access to a legal hotline. The contractor also writes that, upon discovering the incident on 11 October, the company activated its contingency procedures, isolated affected servers and brought in external cybersecurity experts. The investigation is still ongoing, according to the statement.
Sofie Freja Christensen generally highlights the need to establish the extent of the incident and provide those affected with specific information.
- Right now, the priority is to quickly establish whether data has been stolen and tell those affected specifically. Employees whose passports and account numbers may be up for sale need more than “systems are affected”, she says, continuing.
- Going forward, the key lesson is that, according to their own claims, the attackers were inside for almost a month without being detected. It is not only about keeping them out, but about detecting them in time.
FemernBusiness has presented the information to FLC, which has no comment.
