Sensitive data of employees of ASML, Brabant Water and NXP is on the street due to the data breach at telecom provider Odido. This is evident from research by the research platform Follow the Money. The data is extra attractive for intelligence services from, for example, China or Russia, because the employees work in critical sectors.
Out of it research it appears that data has been leaked from 110 (former) employees of chip machine manufacturer ASML from Veldhoven, 288 employees of chip manufacturer NXP in Eindhoven and an as yet unknown number of employees of Brabant Water.
The data was published last weekend by hacker group ShinyHunters after Odido refused to pay a ransom. The Odido leak, in which data from more than six million customers was stolen, is one of the largest data leaks ever in the Netherlands. The hackers posed as employees of the IT department of the telecom company and were able to gain access to the systems in early February.
Data has been leaked from a total of more than 16,000 employees of water companies, network operators, essential government services and security agencies. Three quarters of them are business Odido customers. Phone numbers, passport numbers, dates of birth, bank account numbers and addresses have been leaked.
‘Quite unique’
“The combination of all that sensitive data and the scale of the leak makes this hack fairly unique,” cybersecurity expert Lisa de Wilde told Follow the Money (FTM). She is also familiar with some of the organizations on the FTM list. De Wilde is shocked by the large number of employees from vital and/or strategic sectors on the list.
According to her, cyber criminals can in any case use the leaked information for new cyber attacks. “They try to get in everywhere and then send thousands phishing emailswhere they hope that one person will click on a link that will give them access. Specific information about employees can be useful in this regard.”
Russian or Chinese intelligence services
Criminals can enter when an employee opens such a link or uses a private device on the company’s Wi-Fi network. The data is interesting for, for example, Russian or Chinese intelligence services. “They are willing to put in a lot of time and effort to enter one organization – for example ASML or the Ministry of Defense.”
ASML is aware of the situation and said through a spokesperson: “ASML email addresses may only be used for business purposes. Their use for private accounts is not permitted and is contrary to our Code of Conduct. Employees have been informed about this and are regularly trained.”
In this HOW..? we explain to you how data leaks occur, what hackers can do with your data and how you can prevent yourself from being hacked.
