BianLian Hacker Group Claims ‘MassDevelopment’ Breach, Exfiltrating 4TB of Sensitive Data

• The BianLian Ransomware gang announced exfiltrating 4TB of sensitive data from finance and development agency MassDevelopment.
• Samples posted on the dark web claim the stolen information includes financial and personal data and email archives.
• The hackers say they own some files retrieved from the CFO’s personal computer.

The BianLian hacking group alleged they breached MassDevelopment, Massachusetts' finance and development agency. Approximately 4TB of sensitive data was exfiltrated during the breach, according to the hacking group’s post on the dark web.  

The stolen data reportedly includes a wide array of critical and confidential information, such as accounting, budget, and financial data, as well as personal data.

Hackers claim that the stolen details include contract documentation and NDAs, operational and business files, data allegedly retrieved from the CFO’s personal computer, records pertaining to accidents, and email and message archives.

The extent and implications of the cyberattack are not yet fully understood, as MassDevelopment has not released a statement verifying the claims.

BianLian is a ransomware and data extortion group that has targeted organizations in several critical infrastructure sectors in the US since June 2022. They also attacked Australian critical infrastructure sectors, professional services, and property development.

Cybersecurity experts have noted BianLian’s tendency to exploit outdated systems and vulnerabilities in organizational infrastructure to gain unauthorized access. 

BianLian is known for its double extortion tactics, which involve encrypting the victim’s files and threatening to publish sensitive data unless a ransom is paid. 

The exfiltration of email and message archives, as alleged in this case, often compounds the damage, as it exposes internal communications that could further harm negotiations, partnerships, or contract renewals.

Last year, BianLian Ransomware announced the 2023 Piramal Group data breach on a popular cybercrime forum and claimed to have data belonging to the operators of the Browns Range mine in Western Australia, Northern Minerals.