Ransomware Breach Exposes Direct Access Partners' Data
Incident Date:
September 28, 2024
Overview
Title
Ransomware Breach Exposes Direct Access Partners' Data
Victim
Direct Access Partners
Attacker
Inc Ransom
Location
First Reported
September 28, 2024
Ransomware Attack on Direct Access Partners by INC Ransom
Direct Access Partners, a New York-based financial services firm, has recently fallen victim to a ransomware attack orchestrated by the notorious INC Ransom group. This attack has raised significant concerns within the financial sector, given the firm's reputation for providing specialized brokerage services to institutional clients.
About Direct Access Partners
Direct Access Partners was an institutional brokerage firm known for its agency-only brokerage model, which emphasized client anonymity and non-conflicting execution across multiple asset classes. The firm specialized in global equity, options, and fixed income trading, catering primarily to institutional clients. With approximately 50 employees, the firm reported an estimated annual revenue of $23.9 million, reflecting its competitive position in the financial services sector. Despite its closure due to internal challenges, the firm's focus on client confidentiality and tailored financial solutions made it a standout in the industry.
Details of the Ransomware Attack
The INC Ransom group has claimed responsibility for the attack on Direct Access Partners, asserting that they have exfiltrated sensitive financial data and client information. This breach highlights the vulnerabilities that financial institutions face, particularly those with a history of operational challenges. The attack underscores the importance of effective cybersecurity measures, especially for firms handling sensitive financial transactions and client data.
Profile of INC Ransom
INC Ransom is a sophisticated cybercriminal group known for its targeted ransomware attacks on various industries, including finance, healthcare, and technology. The group employs advanced techniques such as spear-phishing and exploiting known vulnerabilities like CVE-2023-3519 in Citrix NetScaler. Their strategy involves double extortion, where they encrypt and steal data, threatening to release it publicly to pressure victims into paying the ransom. This approach has made them a formidable threat in the cybersecurity landscape.
Potential Vulnerabilities and Attack Vector
While the specific method of infiltration in the Direct Access Partners attack remains unclear, INC Ransom's known tactics suggest potential vulnerabilities in the firm's cybersecurity infrastructure. The use of spear-phishing and exploitation of software vulnerabilities are common entry points for such attacks. Given the firm's previous operational challenges, these vulnerabilities may have been exacerbated, making it an attractive target for cybercriminals.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.