Vhive, a popular furniture retail chain in Singapore, has posted a notice on their web site and Facebook page announcing a cyberattack that occurred on march 23. Based on information provided to DataBreaches.net by the threat actors, this appear to experience been a double extortion attack by ALTDOS threat actors that involves more than 300,000 customer records as wellspring as other types of documents including transactions records and defrayal records. According to Vhive, the onset did not affect NRIC numbers (national registration identity card numbers required for every Singapore resident over age 15). Nor did it reportedly affect any financial information or citation card data. The initial snipe of vhive.com.sg allegedly occurred on march 21, with the private network server breached on march 22. a timeline claimed by the terror actors indicates that Vhive was able to recover its site and files using backups on march 23, but allegedly “failed to resolve major vulnerabilities, allowing ALTDOS to uphold our attacks.” Those attacks allegedly continued on march 25, when ALTDOS downloaded source coding and files, and “encrypted all files on its server with a ransomware attack.” as proof of compromise, ALTDOS provided a number of mp4’s display them scrolling through directories and folders. They also provided some screencaps, including the one below which has been redacted by DataBreaches.net. It shows that there were more than 300,000 records in the “systemv” “customer” table. DataBreaches.net has redacted the customers’ names, addresses, and mobile phone numbers. The threat actors come not indicate what sort of ransomware was involved, but in a past attack, they had informed this site that they generally avoid ransomware and had simply used AES 256 encryption. According to the attackers, there was some dialogue with Vhive management on march 26, and when they asked for more time, ALTDOS gave the firm a 48-hour deadline. On mar 28, Vhive announced the breach on its web site and terminated negotiations with ALTDOS, who predictably responded by announcing that they will start dumping data within a few days. DataBreaches.net reached out to Vhive to ask for more details about the ransomware aspect and to inquire whether they wished to make any additional argument about the attack. This post will be updated if or when a response is received.
