Data Recovery Digest

The experts at Acer are no strangers to ransomware. After all, it was just earlier this year when they fell victim to a $50MM ransomware attack. That attack, which took place in March 2021, was likely the result of vulnerabilities within Microsoft Exchange. Unfortunately, that would just mark the beginning of their woes in 2021.

Officially announced in October 2021, Acer has once again fell victim to a ransomware attack. With approximately 60GB of exposed data, however, the potential fallout could be far more devastating this time around.

A Disturbing Trend

It was October 13 when a hacker group known as Desorden announced, through an online forum post, that they had effectively hacked servers in India belonging to Acer. The post mentions approximately 60 GB of stolen data, including financial and audit data from the company itself, login credentials from Acer distributors, and personal details on millions of customers.

Acer soon confirmed the attack on their end, by releasing a statement that said, in part: “We have recently detected an isolated attack on our local after-sales service system in India. Upon detection, we immediately initiated our security protocols and conducted a full scan of our systems. We are notifying all potentially affected customers in India. The incident has been reported to local law enforcement and the Indian Computer Emergency Response Team, and has no material impact to our operations and business continuity.”

To prove their data was authentic, the hackers immediately released a trove of 10,000 records containing highly sensitive customer data. Independent experts were able to analyze the data and have come to the conclusion that this data appears to be genuine customer data from Acer. Although it’s unclear if a specific ransom has been set in this case, the hackers are actively trying to sell the remaining customer information for a fee.

Additionally, the hackers released a statement that reads: “Acer is a global network of vulnerable systems. We no longer have access to their India servers. This is all we can reveal now.”

History Repeats Itself

This isn’t the first time, or even the second time, that has happened to Acer. In fact, Acer India – the same group that’s affected in the recent attack – experienced a similar ransomware attack all the way back in 2012.

In that case, which exposed the login credentials of approximately 20,000 users, the culprits were a hacking group based out of Turkey. They also managed to deface the company’s website during the incident.

Unfortunately, it seems that Acer has a history of high-profile ransomware attacks. The attack that took place in March 2021 involved a ransom of $50MM, which was to be paid in the cryptocurrency XMR. It was also the highest ransom ever placed in a ransomware attack up until that time.

Whether or not Acer will be able to get their ransomware woes into check is anybody’s guess. They are a very obvious target, especially with hackers pointing out numerous vulnerabilities in recent attacks, and 2021 seems to be a particularly troublesome year for the tech giant.