Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label American Firms. Show all posts

More U.S. Investors Join Legal Dispute With South Korea Over Coupang Data Breach

 



A fresh wave of U.S.-based investment firms has joined an ongoing legal confrontation with the government of South Korea over its handling of a large scale cybersecurity incident involving Coupang.

On February 11, it was confirmed that three additional investors, Abrams Capital, Durable Capital Partners, and Foxhaven Asset Management, have formally moved to participate in arbitration proceedings. These firms are aligning with Greenoaks Capital and Altimeter Capital, which had already initiated legal action. By filing official notices, the new claimants are adopting and supporting the earlier case rather than launching a separate one.

At the center of the dispute is an allegation that South Korean authorities unfairly targeted Coupang and, by extension, other U.S.-linked businesses operating in the country. The investors claim that Seoul’s regulatory response following a large-scale consumer data breach amounted to discriminatory treatment that caused severe financial harm.

The controversy traces back to a disclosure made in November, when Coupang announced that personal information belonging to roughly 33 million customers in South Korea had been exposed in a cyber incident. Data breaches of this scale typically involve unauthorized access to customer records, which may include names, contact information, and other identifying details. The announcement triggered widespread public concern, political scrutiny, legal complaints, and cross-border tensions.

According to the investors pursuing arbitration, the government’s actions after the breach significantly affected shareholder value, resulting in losses amounting to billions of dollars. They argue that the regulatory measures taken were disproportionate and damaged investor confidence.

In addition to arbitration efforts, the newly joined investors have sent letters supporting calls for a formal review by U.S. authorities into South Korea’s conduct. Neil Mehta, founder and managing partner of Greenoaks Capital, stated that American policymakers and investors increasingly view the case as an example of the need to defend U.S. companies against what they see as unfair foreign government actions.

Coupang was established in 2010 by Korean-American entrepreneur Bom Kim, a graduate of Harvard University. Over the past decade, it has become the most widely used e-commerce platform in South Korea, surpassing long-established domestic conglomerates such as Shinsegae in online retail presence. The company has expanded beyond traditional online shopping into food delivery services, streaming platforms, and financial technology offerings, further strengthening its footprint in the country’s digital economy.

South Korea’s Justice Ministry has confirmed receipt of additional notices signaling intent to arbitrate. In an official statement, the ministry said it would respond in a systematic and professional manner through its International Investment Dispute Response Team, indicating that the government intends to formally defend its position.

The issue has also contributed to rising trade friction between Washington and Seoul. U.S. President Donald Trump has warned that tariffs on South Korean goods could increase to as much as 25 percent amid broader economic tensions.

Separately, the United States House Committee on the Judiciary recently issued a subpoena to Coupang as part of an ongoing investigation examining alleged discriminatory treatment of American companies operating abroad.

As arbitration proceedings advance, the case is expected to test not only corporate accountability in the wake of major data breaches, but also the strength of international investment protections and the diplomatic balance between two long-standing economic partners.

KnowBe4 Avoids Data Breach After Hiring North Korean Hacker


 

American cybersecurity firm KnowBe4 recently discovered that a new hire, brought on as a Principal Software Engineer, was actually a North Korean state actor. This individual attempted to install data-stealing malware on the company's devices, but the threat was identified and neutralised before any data breach occurred.

This incident is the testament to the persistent threat from North Korean operatives posing as IT professionals, a danger that the FBI has been warning about since 2023. North Korea has a well-organised network of IT workers who disguise their true identities to secure employment with American companies. The revenue generated by these infiltrators funds the country's weapons programs, cyber operations, and intelligence gathering.

How the Hacker Bypassed Checks

Before hiring the malicious actor, KnowBe4 conducted extensive background checks, verified references, and held four video interviews. Despite these precautions, the individual used a stolen U.S. identity and AI tools to create a fake profile picture that matched during the video calls. This deception enabled the hacker to bypass the initial vetting process.

On July 15, 2024, KnowBe4's Endpoint Detection and Response (EDR) system flagged an attempt to load malware from the Mac workstation recently issued to the new hire. The malware, designed to steal information stored in web browsers, was intended to capture any leftover credentials or data from the computer's previous user.

When confronted by KnowBe4's IT staff, the state actor initially offered excuses but soon ceased all communication.

Deceptive Hiring Practices

KnowBe4 CEO Stu Sjouwerman explained that the scheme involved tricking the company into sending the workstation to an "IT mule laptop farm" near the address provided by the fraudster. The hacker then used a VPN to connect to the device during U.S. working hours, making it seem like they were working as usual.

To prevent similar incidents, KnowBe4 advises companies to use isolated sandboxes for new hires, keeping them away from critical network areas. Additionally, firms should ensure that new employees' external devices are not used remotely and treat any inconsistencies in shipping addresses as potential red flags.

This incident at KnowBe4 zeroes in on the intricate  methods employed by North Korean hackers to infiltrate American companies. By staying vigilant and implementing robust security measures, firms can protect themselves from such threats.


Black Basta Ransomware Hits American Dental Association

 

A new ransomware gang dubbed Black Basta is exfiltrating corporate data and documents before encrypting the firm’s devices. It has quickly catapulted into operation this month and has targeted more than twelve firms in just a few weeks. 

The malicious actors then employ stolen data in double-extortion assaults and demand hefty amounts to decrypt files and prevent the publishing of the victim's stolen data. 

According to BleepingComputer, the American Dental Association was targeted by Black Basta last weekend, prompting the shutdown of some parts of its network. The ADA sent emails to its members noting that some of its systems, including ADA email and Aptify, as well as its webchat and telephone lines, have been disrupted as a result of the attack. 

Impacted systems were immediately taken down, with the ADA leveraging Gmail addresses while its email systems are offline. State dental associations, including those in Florida, New York, and Virginia, have also been hit by the ADA breach. 

The attackers claimed to have leaked 2.8GB of data, which they believe accounts for about 30% of the stolen data from the attack. The exfiltrated files include non-disclosure agreements, W2 forms, accounting spreadsheets, and ADA member data. 

The researchers first uncovered the Black Basta attacks in the second week of April, as the operation quickly began targeting firms worldwide. While not much else is known about the new ransomware gang as they have not begun marketing their operation or recruiting affiliates on hacking forums. 

Black Basta modus operandi 

The ransomware infiltrates into an existing Windows service and exploits it to launch the ransomware decryptor executable. The ransomware then changed the wallpaper to display a message stating, “Your network is encrypted by the Black Basta group. Instructions in the file readme.txt” and reboot the computer into Safe Mode with Networking. 

According to security expert Michael Gillespie, the portal Black Basta ransomware utilizes the ChaCha20 algorithm to encrypt files. Each folder on the encrypted device contains a readme.txt file that has information about the attack and a link and unique ID to log in to the negotiation chat session with the threat actors. 

Subsequently, the ransomware operators demand a ransom and threaten to leak data if payment is not made in seven days, and promise to secure data after a ransom is paid. Unfortunately, the encryption algorithm is secure and there is no way to recover files for free. The data extortion part of these attacks is conducted on the 'Black Basta Blog' or 'Basta News' Tor site, which contains a list of all victims who have not paid a ransom.