ALERT Sangoma Ransomware

[wardmundy]

Sangoma, developers of FreePBX, have been hit with ransomware | Hacker News

news.ycombinator.com

 

[tbrummell]

That's not good...

 

[wardmundy]

 

[kenn10]

I guess everyone is vulnerable one way or another. Totally sucks.

 

[Tonyclewis]

The list here is crazy. Things like 3CX trying to buy them and all the details on that. Top 500 customers, salaries of staff. VPN keys. Yikes. And this is only 5% of what they got and only a single employee folder it looks like that they dumped. Be interesting to know what else they got and if they dump things like the CEO and CFO files for everyones to see.

 

[Regardo122]

It seems that part 2 was released today..23GB which is 100% of the data. 90% is documents, there’s however a 2Gb sql backup included..

 

[pbxinaflash]

Sangoma Technologies Confirms Data Breach as Result of Ransomware Attack - Sangoma Technologies

MARKHAM, ONTARIO, December 24, 2020 – Sangoma Technologies Corporation (TSXV: STC) (the “Company” or “Sangoma”) announced that, as a result

www.sangoma.com

 

[wardmundy]

 

[jerrm]

"I want to put out this video to sort of get ahead of any speculation..." followed by 10 minutes of speculation.

 

[wardmundy]

Yet another reason Incredible PBX always locks down the FreePBX GUI and Apache to trusted IP addresses.

 

[thejames]

The latest cookie cutter press release has been released. Cliff notes is they have no evidence any customer financial data or code has been comprimised. Identity theft protection if you are a current employee apparently.

 

[jerrm]

But really, what more can they say? The best we are going to get is "no evidence." No way in heck the attorneys will EVER clear a definitive "nothing occurred to impact the security of our customers/cloud platforms/code base/etc." They can do the most thorough investigation possible, but at the end of the day there is always a possibility something is missed.

 

[thejames]

But really, what more can they say? The best we are going to get is "no evidence." No way in heck the attorneys will EVER clear a definitive "nothing occurred to impact the security of our customers/cloud platforms/code base/etc." They can do the most thorough investigation possible, but at the end of the day there is always a possibility something is missed.

I posted in the other forums that I generally think if Sangoma plays ball everything will be ok. The attackers want a payday and will not compromise that. The risk comes if they don't play ball and the data gets put in the wild. The people responsible for the breach won't use the data. They not only want this payday but hundreds of others. If a company thinks there is no point in paying that isn't good for them. That data is as safe as it can be while there is still potential of a payday.