Publicly disclosed information for this event

Index Number:

Title:

2023_011

A museum is victim of an attack with financial consequences.

Day	Month	Year	Country	Activity	Incident Type
6	March	2023	Australia	Administration	Intrusion

Summary

According to sources, the victim faced an internal cyberattack in which a 23-year-old individual, who was reportedly an IT support worker for a third-party contractor for the museum, accessed financial records and systems. The attacker manipulated the account payable system, replacing the information with his own and conducting multiple unauthorized purchases. Suspicion arose when discrepancies were detected in financial data provided to contracted companies. After engaging independent forensics experts, the museum discovered anomalies and reported the incident to the police.

The suspect's involvement in the attack was traced, leading to his arrest and the seizure of electronic items. The attacker would have redirected around $90,000 as part of the cybercrime.

Victim

Australian National Maritime Museum

Claimed/Reported Threat Actor

N/A

Origin

Cybercrime

Main impact

Confidentiality

References

https://www.cybersecurityconnect.com.au/Industry/8769-australian-national-maritime-museum-suffers-internal-cyber-attack

Recommendations to Administration to reduce Intrusion risks:

Implement strong access controls and authentication mechanisms to limit unauthorized access, such as Multi Factor Authentication.
Regularly update and patch software and systems to address known vulnerabilities.
Use Network Intrusion Detection Systems (NIDS) to monitor and block suspicious activities.
Segment your network to limit lateral movement by attackers in case of a breach.
Educate your employees about phishing attacks and social engineering tactics to prevent credential theft.

Previous Next

Disclaimer: the data are provided as is. France Cyber Maritime and the M-CERT take no responsibility for the soundness, quality, precision, nor the eventual attribution made by the referenced URLs. We give a lot of respect and support to the victims of attacks.

Files generated on Monday, 11th December 2023.
ADMIRAL is licensed under the Creative Commons