![Dark Reading Global Logo Dark Reading Global Logo](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc8a6395802cafad0/654e0d60123f32040a075bab/Dark_Reading_Logo_Global_k.png?width=700&auto=webp&quality=80&disable=upscale)
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa.
Egyptian E-Payment Vendor Recovering From LockBit Ransomware Attack
Fawry confirms addresses, phone numbers, and dates of birth, leaked online.
![Egypt flag with binary code running vertically and hooded figures in the background Egypt flag with binary code running vertically and hooded figures in the background](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf2715674dd091007/65661018c473c3040a1c07e8/egypt_hackers_3D_generator_alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
The LockBit 3.0 ransomware group successfully encrypted files and also allegedly exfiltrated data from Egyptian e-payment provider Fawry.
Word of the breach went public when LockBit published on its dedicated leak site on Nov. 8 a sample of data that was allegedly stolen during the breach of Fawry’s infrastructure. The following day, cybersecurity monitoring platform Hackmanac claimed that the LockBit 3.0 ransomware attack had extracted the personal details of Fawry customers, leading to multiple banks advising customers to remove their account information from Fawry's platform.
Hit Files and Data
In a statement this week about the attack, Fawry said: "Fawry remains confident that this data will not impact financial transactions on its platform, but the company believes it may have included the personal details of some customers whose information had been on the testing platform as part of a system migration project." It also confirmed that some of the leaked details include addresses, phone numbers, and dates of birth.
Group-IB was called in to investigate the incident on Nov. 9, and over three days, it deployed "proprietary advanced cybersecurity solutions across 100% of Fawry’s server infrastructure," declaring the production and testing environments to be "clean as of Nov. 23 of LockBit presence."
Anurag Gurtu, CPO and co-founder of StrikeReady, says the Fawry cyberattack is notable for several reasons, including that the breach occurred in an isolated part of Fawry's network.
He describes Fawry’s response to the breach as "proactive" given that it employed a cybersecurity firm to investigate the attack. Gurtu recommends that other financial services entities consider the impact of this incident, and for them to take "precautionary measures to protect against potential data misuse."
However, Sumatra Sarkar, associate professor at the School of Management at Binghamton State University of New York, criticized Group-IB and Fawry for the "limited information" released, making it "challenging to assess the adequacy of the response to the incident."
Read more about:
DR Global Middle East & AfricaAbout the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024