BlackBerry is investigating an incident involving Cylance data being offered for sale on the dark web, but the company says the data appears old and it does not originate from its own systems.
Dark Web Informer reported last week that a threat actor is hoping to get $750,000 for data allegedly belonging to customers, partners and employees of BlackBerry’s Cylance cybersecurity unit.
The endpoint security company Cylance became part of BlackBerry in 2019, following its acquisition for $1.4 billion.
The cybercriminals are claiming to be in the possession of “34,000,000 million customer and employee emails”. They claim to have obtained customer emails, personally identifiable information, sales prospects, and user and partner lists.
Contacted by SecurityWeek, BlackBerry said it’s aware of the potential data breach and it’s in the process of conducting an investigation. At this point there is no evidence that BlackBerry data and systems related to customers, products, and operations have been compromised.
“Based on our initial reviews of the data in question, no current Cylance customers are impacted, and no sensitive information is involved,” BlackBerry said. “The data in question was accessed from a third-party platform unrelated to BlackBerry and appears to be from 2015-2018, predating BlackBerry’s acquisition of the Cylance product portfolio.”
“We continue to monitor this situation closely and will take all necessary precautions to maintain the integrity of our products and systems and the trust of our customers,” it added.
Emsisoft threat analyst Brett Callow noted that the Cylance data may have been obtained as a result of the recent campaign targeting customers of cloud data platform Snowflake.
The Snowflake campaign has impacted many organizations, including high-profile companies such as Ticketmaster, Anheuser-Busch, Allstate, Advance Auto Parts, Mitsubishi, Neiman Marcus, Progressive, Santander Bank, and State Farm.
Mandiant reported on Monday that roughly 165 organizations have been affected by this campaign, in which attackers seem to be leveraging stolen Snowflake customer credentials to target their cloud storage.
According to Mandiant, the attacks are conducted by a financially motivated threat actor and the user credentials leveraged by the hackers have been obtained by infostealer malware from the systems of Snowflake customers.
There is no evidence that the attacks involved a vulnerability in Snowflake systems or products, or that the vendor’s production or corporate systems have been compromised.
BlackBerry did not specifically confirm or deny that the data comes from Snowflake, but highlighted that the company is currently not a Snowflake customer.
*updated to add that BlackBerry is not currently a Snowflake customer
Related: BBC Data Breach Impacts 25,000 Employees
Related: Hackers Boast Ticketmaster Breach on Relaunched BreachForums
Related: Okta Warns of Credential Stuffing Attacks Targeting Cross-Origin Authentication
