Cybercrime

Virginia County Confirms Personal Information Stolen in Ransomware Attack

Southampton County in Virginia last week started informing individuals that their personal information might have been compromised in a ransomware attack.

The incident was identified in September, when a threat actor accessed a server at Southampton and encrypted the data that was stored on it.

Ionut Arghire

November 28, 2022

Southampton County in Virginia last week started informing individuals that their personal information might have been compromised in a ransomware attack.

The incident was identified in September, when a threat actor accessed a server at Southampton and encrypted the data that was stored on it.

The county says that it took steps to contain the attack immediately after identifying it, and that it launched an investigation into the incident, to determine the type of data that might have been compromised.

The investigation revealed that personal information such as names, addresses, driver’s license numbers, and Social Security numbers might have been compromised, the county says in a notification letter sent to impacted individuals, a copy of which was submitted to the Montana Attorney General.

“Although we have no conclusive evidence that the cybercriminal was successful in removing your personal information from Southampton’s server, out of an abundance of caution we wanted to alert you to this matter and provide you with free credit monitoring,” the letter reads (PDF).

Southampton County also confirmed that the threat actor behind the attack has posted some of the stolen data online.

“After Southampton recovered from this incident, a single W-2 form appeared on the dark web with the criminal claiming that they removed sensitive data from the encrypted Southampton server. The server in question held some archived County information,” the letter reads.

In September, the LockBit 3.0 gang boasted on their leaks site on the Tor network about the attack on Southampton County.

The ransomware gang has only made public several screenshots showing mostly the names of folders allegedly stolen from the county’s systems. However, the page dedicated to Southampton also displays a ‘destroy all information’ button and a ‘download data at any moment’ button, both with a price tag of $90,000.

Written By Ionut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Latest News

Click to comment

Dealing With the Carcinization of Security

Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies.

Marc Solomon

Stop, Collaborate and Listen: Disrupting Cybercrime Networks Requires Private-Public Cooperation

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Derek Manky

How the Atomized Network Changed Enterprise Protection

Our networks have become atomized which, for starters, means they’re highly dispersed. Not just in terms of the infrastructure – legacy, on-premises, hybrid, multi-cloud, and edge.

Matt Wilson

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George