Educational Services Provider Iddink Group Faces Cyber Threat from Cactus Ransomware
Incident Date:
April 26, 2024
Overview
Title
Educational Services Provider Iddink Group Faces Cyber Threat from Cactus Ransomware
Victim
Iddink Group
Attacker
Cactus
Location
First Reported
April 26, 2024
Cyberattack on Iddink Group by Cactus Ransomware Group
Overview of Iddink Group
Iddink Group, a prominent educational services provider based in the Netherlands, was founded in 1922. The company specializes in developing educational platforms and providing a variety of educational products and services. With a revenue of $14.2 million in 2021 and a customer base of 2 million, Iddink Group has established a significant presence in the educational sector. The company employs 203 individuals, with a notable percentage dedicated to engineering and sales roles.
Details of the Ransomware Attack
The Cactus ransomware group, known for its sophisticated cyberattack techniques, targeted Iddink Group, leading to the exfiltration of approximately 460 GB of sensitive data. This data included personal identifying information, financial documents, customer data, database exports, confidential documents, corporate correspondence, employees' personal documents, and private software sources. The attack also compromised the corporate infrastructure of Iddink Group, potentially through the use of an Infostealer, affecting 1470 user credentials and credentials of 2 third-party employees.
Implications and Vulnerabilities
The attack on Iddink Group underscores the vulnerabilities inherent in organizations that manage large volumes of sensitive data. The educational sector, with its extensive digital footprints and reliance on technology for administrative and educational purposes, presents a lucrative target for cybercriminals. The breach of Iddink's systems not only jeopardizes the privacy of millions of users but also highlights the critical need for robust cybersecurity measures in the educational technology industry.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.