iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Oil and gas company Shell is the latest victim of a hack that has so far affected more than 200 companies worldwide.
The company confirmed it had been caught up in the already infamous third-party hack of the file transfer application MOVEit in a statement on Wednesday (5 July).
In what looks to be much the same copy that is being shared with possible victims of the MOVEit breach, Shell said it is trying to contact victims and that some personal information has been affected.
“A cyber security incident that has impacted a third-party software from Progress called MOVEit Transfer, which was running on a Shell IT platform,” the Shell notice read. “MOVEit Transfer is used by a small number of Shell employees and customers.”
“This was not a ransomware event,” Shell stated. “There is no evidence of impact to any other Shell IT systems. Our IT teams are investigating.”
“Some personal information relating to employees of the BG Group has been accessed without authorisation.”
The notice then gives a number of toll-free numbers for employees to call in countries ranging from Malaysia to Australia and the United Kingdom to Canada. A number for the US has not been supplied, suggesting the affected data comes from a limited subset of countries that Shell operates in.
The Clop ransomware gang has taken responsibility for the hack, having exploited a vulnerability in MOVEit in May. So far, the data of more than 15 million individuals have been affected, as well as companies such as Medibank and PwC here in Australia, and Siemens Energy, British Airways, and the US Department of Health.
Clop has already started sharing some of the data publicly, including that stolen from Shell.
Analysis
Supply chain attacks like this are fast becoming the number one fear of cyber security professionals.
A company can have all the latest and greatest when it comes to internal staff and security tools, but if the other tools you’re company is using — from software like MOVEit, or hardware such as the network email devices, which saw the ACT government affected by a data breach — then all that work is for nought.
It’s not enough to audit your own network environment. Companies need to be asking hard questions of their third-party suppliers.
What steps are they taking to secure your data?
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
Be the first to hear the latest developments in the cyber industry.
