\n<\/p>\n
The number of victims<\/span> affected by a mass-ransomware attack, caused by a bug in a popular data transfer tool used by businesses around the world, continues to grow as another organization tells TechCrunch that it was also hacked.<\/p>\n Canadian financing giant Investissement Qu\u00e9bec confirmed to TechCrunch that \u201csome employee personal information\u201d was recently stolen by a ransomware group that claimed to have breached dozens of other companies<\/a>. Spokesperson Isabelle Fontaine said the incident occurred at Fortra, previously known as HelpSystems, which develops the vulnerable GoAnywhere file transfer tool.<\/p>\n Hitachi Energy also confirmed<\/a> this week that some of its employee data had been stolen in a similar incident involving its GoAnywhere system, but saying the incident happened at Fortra.<\/p>\n Over the past few days, the Russia-linked Clop gang has added dozens of other organizations to its dark web leak site, which it uses to extort companies further by threatening to publish the stolen files unless a financial ransom demand is paid.<\/p>\n TechCrunch has also found dozens of organizations that used the affected GoAnywhere file transfer software at the time of the ransomware attack, suggesting more victims are likely to come forward.<\/p>\n However, while the number of victims of the mass-hack is widening, the known impact is murky at best.<\/p>\n Since the attack in late January or early February \u2014 the exact date is not known \u2014 Clop has disclosed less than half of the 130 organizations it claimed to have compromised via GoAnywhere, a system that can be hosted in the cloud or on an organization\u2019s network that allows companies to securely transfer huge sets of data and other large files.<\/p>\n It isn\u2019t clear if Fortra, which has not publicly commented on the incident, knows yet which customers are affected.\u00a0When reached by email prior to publication, Fortra spokespeople Mike Devine and Rachel Woodford would not comment or provide answers to any of our questions, including whether Fortra\u2019s in-house GoAnywhere systems hosting customers\u2019 data were also hit by the mass-hack.<\/p>\n Details only came to light on February 2 after independent security reporter Brian Krebs first reported<\/a> details of the bug, which Fortra had hidden behind a login screen on its website. Fortra released security fixes for GoAnywhere five days later on February 7.<\/p>\n By then, the hackers had already stolen reams of data from numerous victims.<\/p>\n Healthcare giant Community Health Systems<\/a>, one of the largest healthcare providers in the United States, was first to confirm that it was one of the 130 alleged companies fallen victim to the hack, saying at least one million patients had their health information stolen from its affected GoAnywhere system. Digital finance giant Hatch Bank<\/a> was next to confirm a breach linked to the GoAnywhere bug, then cybersecurity giant Rubrik<\/a>. The list continues to grow.<\/p>\n It\u2019s not clear if Clop yet knows what data it has stolen in its digital smash-and-grab. TechCrunch contacted some of the organizations known to use GoAnywhere that were recently added to Clop\u2019s leak site. Several responded saying that they were unaffected.<\/p>\n Payment software startup AvidXchange, one of Clop\u2019s latest additions, told TechCrunch that while it uses GoAnywhere to transfer files to a specific company that prints its checks, the company does not store any data on Fortra\u2019s platform.<\/p>\n \u201cOur forensics further prove our conclusion on this matter,\u201d said AvidXchange spokesperson Olivia Sorrells. \u201cFortra notified AvidXchange of the vulnerability, remediation, and the results of their investigation regarding AvidXchange\u2019s GoAnywhere account the week that the [vulnerability] was announced,\u201d the spokesperson said. \u201cGoAnywhere took AvidXchange\u2019s instance offline once GoAnywhere became aware of the incident to further prevent unauthorized access to the platform.\u201d<\/p>\n Clop\u2019s leak site says that data from AvidXchange is \u201ccoming soon.\u201d<\/p>\n Department store giant Saks Fifth Avenue, which was added to Clop\u2019s leak site this week, tells TechCrunch that the hackers exploited the GoAnywhere flaw to steal mock customer data from its systems. \u201cThe mock customer data does not include real customer or payment card information and is solely used to simulate customer orders for testing purposes,\u201d said Saks spokesperson Nicola Schoenberg.<\/p>\n A number of other organizations recently added to Clop\u2019s site declined to comment when asked if their GoAnywhere systems \u2014 most believed to be hosted by Fortra \u2014 were affected.<\/p>\n That includes Swiss pharmaceutical giant Galderma, whose spokesperson Christian Marcoux declined to answer our questions; healthcare call center provider ITx Companies, whose CEO Philip Gower declined to comment; child mental health startup Brightline, whose CEO Naomi Allen deferred to spokesperson John O\u2019Connor, who declined to comment; events planner Emerald Expositions, whose spokesperson Beth Cowperthwaite declined to comment; and MedMinder, whose spokesperson Stacy Clougherty said MedMinder is \u201caware of the allegations\u201d but declined to comment further while the company investigates.<\/p>\n None of the companies disputed that they are GoAnywhere customers.<\/p>\n Clop has released samples of data allegedly stolen from Onex, seen by TechCrunch, including W-9 tax forms, payment orders, and employee information, including names, gender, and email addresses. Onex did not return requests for comment.<\/p>\n One of the organizations identified by TechCrunch as a\u00a0GoAnywhere customers but not yet listed by Clop is the City of Toronto, which said it was unaffected by the mass-hack.\u00a0\u201cThe City and Fortra have conducted a review and determined that there has been no exfiltration of internal data, nor residents\u2019 data,\u201d said city spokesperson Ashika Theyyil.<\/p>\n Other identified GoAnywhere users did not respond to multiple requests for comment, including Canadian rehab and mental health provider Homewood Health; England-based affordable housing provider Guinness Partnership; retail banking company Avidia Bank; Medex Healthcare; Cornerstone Home Lending, and Colombian energy giant Grupo Vanti.<\/p>\n Lorenzo Franceschi-Bicchierai contributed.<\/em><\/p>\n If you know more about the Fortra bug or breach, you can contact Carly Page securely on Signal at +441536 853968, or by email<\/a>. You can also contact Zack Whittaker on Signal and WhatsApp at +1 646-755-8849 or zack.whittaker@techcrunch.com<\/a>. You can also contact TechCrunch via SecureDrop<\/a>.<\/em><\/p>\n<\/p><\/div>\n\u2018130 organizations\u2019<\/h2>\n
Listed companies deny data thefts<\/h2>\n