Woodkirk Stone
Multinational food conglomerate Nestlé has denied suffering a cyberattack after a Twitter account linked to hacking group Anonymous 10 GB treasure leak information that would have included emails, passwords and customer information.
A Nestlé spokesperson told The Record the data came from a situation that arose in February.
“This allegation of a cyberattack against Nestlé and subsequent data breach has no basis. This is a case from February this year when some randomized and mostly publicly available test data of a B2B nature was unwittingly made available online for a short time on a single corporate testing website. “said the spokesperson.
“We promptly investigated and no further action was deemed necessary. Cybersecurity is one of our top priorities. We are continuously monitoring the IT landscape and taking all necessary steps to ensure we remain resilient in terms of cybersecurity.”
Tuesday, several anonymous Twitter accounts published a mySQL dump of 10 GB of Nestlé data after threatening companies that continued to do business in Russia following the invasion of Ukraine.
The group – which made waves early in the invasion by threatening to attack the Russian government itself – listed several companies it planned to sue, including Nestlé, Cargill, Subway, Burger King, General Mills, Bridgestone, Koch, Chevron and others.
“We call on all companies that continue to operate in Russia by paying taxes to the budget of the criminal Kremlin regime: Get out of Russia! We give you 48 hours to think it over and withdraw from Russia, otherwise you will be under our lens! said the anonymous account.
Oran Avraham, CTO of Laminar, said after analyzing the data, it was clear that the compromised database was likely from a test/staging environment.
“This is often a prime target for attackers because these copies tend to be unknown, less protected, and unmonitored by data security teams. We call this phenomenon “ghost data”. In a recent study of 500 security professionals, 82% said they were concerned or very concerned about ghost data between environments,” Avraham said.
“This incident reminds us that with the majority of global data residing in the cloud, it is imperative that security becomes data-centric and solutions become cloud-native. This same study shows that one in two companies has experienced a cloud breach in the past two years. »