BlackSuit Ransomware Stole 950,000 Customers’ Data from ‘Young Consulting’ Software Provider 

• A security incident exposed the data of more than 950,000 Young Consulting customers, including Blue Shield of California.
• Impacted information includes names, Social Security numbers, and dates of birth.
• The BlackSuit ransomware gang claimed the attack and leaked the data soon after.

Atlanta-based software solutions provider Young Consulting (now Connexure) was hit by a BlackSuit ransomware attack that resulted in the exfiltration of 954,177 customers’ data. The cyberattack allegedly occurred on April 10 and encrypted the company’s systems three days later.

The potentially affected information includes a combination of certain individuals’ names, Social Security numbers, dates of birth, and insurance policy/claim information. Among the notified victims are members of the Blue Shield of California, which was hit by a BlackSuit ransomware attack earlier this year.

The company started sending breach notifications to the impacted clients and offering complimentary credit monitoring and identity theft restoration services via Equifax, Experian, or TransUnion. The company’s report mentions that there’s no evidence of misuse yet.

BlackSuit claimed the Young Consulting data breach on May 7 and leaked the stolen data a few weeks later, which apparently included business, employee, financial, and personal data.

The BlackSuit ransomware attack suffered by the Japanese KADOKAWA Corporation in June leaked the details of 254,000 people. This included all employees and some business partners and affiliates, and sensitive data, including names, email addresses, and phone numbers, was exposed in the process.

BlackSuit was also behind the massive American retail technology and software provider CDK Global cyberattack that crippled thousands of U.S. car dealerships. In June, BlackSuit allegedly published hundreds of sensitive police files stolen from the Kansas Police Department after the KCKPD refused to pay ransom.

BlackSuit is a suspected rebrand of the Royal ransomware operation, which is believed to be the successor of the Conti cybercrime group of Russian and Eastern European threat actors.