IT consulting giant Infosys' U.S.-based subsidiary, McCamish Systems, experienced a significant data breach. Following a November ransomware attack attributed to the LockBit ransomware operation, data from over 6.078 million individuals was compromised reported Security Affairs.
Initially, it was believed that sensitive information on approximately 57,000 people had been stolen. However, further investigation revealed that the threat actors had accessed valuable intel on more than six million individuals.
The stolen data includes a wide range of personal information, such as Social Security Numbers (SSN), birth dates, medical details, biometric data, email addresses, passwords, Driver’s License numbers, state ID numbers, financial account information, payment card details, passport numbers, Tribal ID numbers, and US military ID numbers. This wealth of information could potentially be used for phishing or identity theft attacks.
Infosys McCamish, the center of excellence for Infosys' Life Insurance software solutions and services offerings in the U.S., has been providing software and services to the life insurance industry for over 22 years.
To mitigate the impact, McCamish Systems provided affected individuals with free identity protection and credit monitoring services through Kroll for a period of two years. The incident was initially reported by Bank of America, which identified Infosys McCamish Systems as an outside counsel for the bank.
The specific details of how the breach occurred have not been publicly disclosed. However, ransomware attacks often exploit vulnerabilities in software, weak passwords, or social engineering tactics. In the case of Infosys McCamish Systems, the LockBit ransomware group likely gained unauthorized access to their systems, encrypted data, and demanded a ransom for its release. Organizations typically respond by enhancing security measures, patching vulnerabilities, and improving incident response protocols to prevent future breaches.
Advertisements