Kevin BeaumontAnother #CitrixBleed ransomware. Fidelity National Financial
Source = me or whatever. They patched Netscaler late, visible on Shodan.
Transparency: Deleted a toot in this thread. I flagged another company called Fidelity who also patched late.
Restoring toot - it turns out Fidelity National Financial, Inc. and Fidelity National Information Service merged years ago. Both patched #CitrixBleed late and now have security incidents involving a ransomware group.
BlackCat ransomware group have claimed Fidelity National Financial, a Fortune500 company. HT @AlvieriD #threatintel
Fidelity National Financial’s website is offline. https://fnf.com/ (or intermittently available depending on location)
Fidelity National Financial ransomware incident is causing problems across the US housing market. They own a ton of downstream companies, eg Chicago Title, and they’re also offline. https://dataconomy.com/2023/11/23/fidelity-national-financial-data-breach/
Btw it isn’t out in the media yet it’s ransomware, but it definitely is.
Fidelity National Financial have been removed from BlackCat’s ransomware portal. Translation: they paid.
The Fidelity National Financial breach by AlphV with CitrixBleed continues to have ripple effect https://www.bleepingcomputer.com/news/security/mortgage-firm-loancare-warns-13-million-people-of-data-breach/
Lesley Carhart 
@GossiTheDog phewwww they have their hands in a lot of people’s shit, often involuntarily
Avoid the Hack! 
@GossiTheDog guess we'll see the leak in a few months.
Also... double-extortion incoming in near future.
Andrzej Stamburski@GossiTheDog Just to summarise the results of paying hackers:
- Stolen data will still be misused in any possible way (but quiet, without attributing to the victim)
- Hackers will do whatever possible to maintain the access to the victim IT systems (but they will temporarily not use it)
- Restoring hacked systems will still cost fortune (even getting some help from hacker initially, there's still a lot to do)
So the only reason to pay hackers is because otherwise shareholders will panic, right?
- Stolen data will still be misused in any possible way (but quiet, without attributing to the victim)
- Hackers will do whatever possible to maintain the access to the victim IT systems (but they will temporarily not use it)
- Restoring hacked systems will still cost fortune (even getting some help from hacker initially, there's still a lot to do)
So the only reason to pay hackers is because otherwise shareholders will panic, right?
Matt Blaze@GossiTheDog Just to confirm, since there seem to be dozens of financial industry firms named "Fidelity", this is a different Fidelity from the place that holds my 401(k), correct?
Tim Farley@mattblaze @gossithedog It is a different company.