The hackers who breached data storage giant Western Digital claim to have stolen around 10 terabytes of data from the company, including reams of customer information. The extortionists are pushing the company to negotiate a ransom — of a “minimum 8 figures” — in exchange for not publishing the stolen data.
On April 3, Western Digital disclosed “a network security incident” saying hackers had exfiltrated data after hacking into “a number of the Company’s systems.” At the time, Western Digital provided few details about exactly what data the hackers stole, saying in a statement that the hackers “obtained certain data from its systems and [Western Digital] is working to understand the nature and scope of that data.”
One of the hackers spoke with TechCrunch and provided more details, with the goal of verifying their claims. The hacker shared a file that was digitally signed with Western Digital’s code-signing certificate, showing they could now digitally sign files to impersonate Western Digital. Two security researchers also looked at the file and agreed it is signed with the company’s certificate.
The hackers also shared phone numbers allegedly belonging to several company executives. TechCrunch called the numbers. Most of the calls rang but went to automated voicemail messages. Two of the phone numbers had voicemail greetings that mentioned the names of the executives that the hackers claimed were associated with the numbers. The two phone numbers are not public.
Screenshots shared by the hacker show a folder from a Box account apparently belonging to Western Digital, an internal email, files stored in a PrivateArk instance (a cybersecurity product) and a screenshot of a group call where one of the participants is identified as Western Digital’s chief information security officer.
They also said they were able to steal data from the company’s SAP Backoffice, a back-end interface that helps companies manage e-commerce data.
The hacker said that their goal when they hacked Western Digital was to make money, though they decided against using ransomware to encrypt the company’s files.
“I want to give them a chance to pay but our callers […] they have called them many times. They don’t answer and if they do they listen and hang up,” the hacker said.
The hacker said they have also emailed several executives — using their personal email addresses because the corporate email system is currently down — demanding a “one-time payment.”
“We are the vermin who breached your company. Perhaps your attention is needed!” the hackers wrote, according to a copy of the email the hackers shared with TechCrunch. “Continue down this path and we will retaliate.”
“We only need a one-time payment, and then we will leave your network and let you know about your weaknesses. No lasting harm has been done. But if there are any efforts to interfere with us, our systems, or anything else. We will strike back,” the hackers continued. “We are still buried in your network and we will keep digging there until we find a payment from you. We can completely conceal this and make it all disappear. Before it is too late, let us do that. Until now, you have been gracious; Let’s hope that you do not keep going the wrong way.”
“Cut the crap, get the money, and let’s both go our separate ways. Simply put, let us put our egos aside and work to find a resolution to this chaotic scenario,” the hackers wrote.
Western Digital spokesperson Charlie Smalling said the company declined to comment or answer questions about the hacker’s claims, such as whether the company could confirm the amount of data stolen, if it included customer data and whether the company had made contact with the hackers.
The hacker who spoke to TechCrunch declined to specify what kind of customer data they have, how they originally broke into Western Digital’s network and how they maintained access to the company’s network.
“I can say that we exploited vulnerabilities within their infrastructure and spidered our way to global administrator of their [Microsoft] Azure tenant,” the hacker said.
As for why they hacked Western Digital, the hacker said they just come up with targets “randomly.” They also declined to say anything about themselves or the group, saying they don’t go by any name.
If Western Digital doesn’t get back to them, the hacker said, they are ready to start publishing the stolen data on the website of the ransomware gang Alphv. The hacker said they are not directly affiliated with Alphv but “I know them to be professional.”
Do you have more information about the Western Digital hack? We’d love to hear from you. You can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Wickr, Telegram and Wire @lorenzofb, or email [email protected]. You can also contact TechCrunch via SecureDrop.
