← Ubiquiti

2021 — The US Department of Justice says(Opens in a new…

2021 Unknown records affected Share on X

Data compromised

Internal

Technical writeup

The US Department of Justice says(Opens in a new window) it's arrested Nickolas Sharp for allegedly stealing information from an unidentified technology company, demanding a $2 million ransom in exchange for the compromised data, and pretending to be a whistleblower in communications with reporters. The DOJ accuses Sharp of "secretly stealing gigabytes of confidential files from a New York-based technology company where he was employed...and then, while purportedly working to remediate the security breach, extorting the company for nearly $2 million for the return of the files and the identification of a remaining purported vulnerability." BleepingComputer reports(Opens in a new window) that Sharp was employed by Ubiquiti, a networking equipment provider that disclosed a data breach in January. Brian Krebs of KrebsOnSecurity reported(Opens in a new window) in March that an anonymous whistleblower claimed the Ubiquiti breach was "catastrophic" and that the company was covering up the full extent of the incident to protect its share price.

Root cause

Misuse: Privilege abuse

References