Bad news: Cognizant hit by ransomware gang. Worse: It's Maze, which leaks victims' data online after non-payment

New Jersey IT services provider Cognizant has confirmed it is the latest victim of the Maze ransomware. The infection was disclosed to the public this weekend. Cognizant said the malware outbreak will likely disrupt service for some of its customers, and possibly put them in danger as well. Maze is unusual among ransomware …

[Phil Kingston]

They are never going to financially recover from this

[Mark192]

Could be great for them. Assuming it's not if you'll be hacked but when, recovering from this with minimal disruption, data intact and no documents leaked could be a PR win...

[Lotaresco]

"recovering from this with minimal disruption, data intact and no documents leaked"

Did you miss the information about Maze? Escaping from this with no documents leaked is an unlikely scenario.

[LucreLout]

They are never going to financially recover from this

In a world where people still buy broadband from TalkTalk, bank with TSB, and trust the NHS with their data, I think you may have underestimated peoples ability to completely disregard past incidents when obtaining services.

[Gene Cash]

And fly with RyanAir!

[Lotaresco]

Last time I checked no one was flying with Ryanair, other than Ryanair crew.

[macjules]

A definite schadenfreude moment

Recall a colleague at Cognizant emailing me at WPP to ask how IT security was going post Not-Petya.

[julian_n]

I mean, out sourcing and putting your data out on the cloud - who would have thought anything could ever go wrong.

[Lotaresco]

Significant failures

As usual when an organization reports a successful malware attack there are significant gaps and elements of whitewash in the announcements. Two areas that interest me are the vector for the attack - it looks like it may have been spear phishing, the usual vector for ransomware, and the apparent weakness of any security controls.

For the first part it appears that Cognizant permits users with administrator access to access the internet/corporate mail from privileged accounts. Oops.

For the second it appears there are no controls to prevent lateral movement, no SOC, no alerting when there's unusual activity such as large volumes of data being transmitted, no IPS, no IDS, no AV on the wire... (etc).

I'm guessing that they are already working on the standard letter that says that they have the best security in the world but were unable to defend customer accounts because of the extremely sophisticated attack.

[Doctor Syntax]

Re: Significant failures

"I'm guessing that they are already working on the standard letter that says that they have the best security in the world but were unable to defend customer accounts because of the extremely sophisticated attack."

They had it written and ready but it got encrypted.

[Anonymous Coward]

reads like an inside job.

[Anonymous Coward]

Keep the money

Criminals don't have ethics, they will sell the data eventually, it's to valuable not to.

Don't pay your murderer from your deathbed.

Just close up gracefully.

[YetAnotherJoeBlow]

Troubles

My wife does work for Cognizant. Three weeks ago, they sent her a new computer; they were supposed to be online for the better part of two weeks now. Now I know why they have not communicated with her. Her Cognizant email address still works though.

[Anonymous Coward]

We use them in a small way. Thankfully we hadn't really got started yet.

[Anonymous Coward]

Security? I doubt they’ve heard of that

Back when I worked for them we weren’t supplied with a corporate laptop or PC so everyone had to use their own kit. The web apps for everything were truly dire and needed ancient versions of IE to work. It got to the point where I had a really old crappy laptop just to use for timesheets and admin crap, I didn’t want my own laptop anywhere near their network.