Hackers Cause Data Breach After Infiltrating OnTrac Network

What Happened

OnTrac, a leading parcel and package delivery company in the United States, has announced that customer data may have been exposed following a cyberattack on its corporate network. In an official notification from the company, it was stated that warning letters have begun to be sent to customers due to a security incident detected in March. This development indicates that the cybersecurity defenses of a company that is a critical part of e-commerce logistics and serves millions of Americans have been breached.

OnTrac is a private company formed in 2021 from the merger of OnTrac Logistics and LaserShip, specializing in "last-mile" delivery for e-commerce shipments. Operating from 102 locations across 35 states, the firm has a vast service network covering approximately 70% of the U.S. population. This massive operation, which works with more than 7,000 independent delivery contractors, highlights the potential scope of the attack's impact. The company's scale makes it an attractive target for attackers, and the consequences of the breach have the potential to affect a large number of individuals.

What Data Was Compromised

In the data breach notification sample submitted to authorities by OnTrac, the specific types of data accessed by the attackers are largely redacted. However, according to the company's statement, it is confirmed that the leaked information includes customer names. What other types of personal or financial data were compromised besides names has not been shared with the public. This uncertainty increases concern among affected customers. Even the leak of names alone poses a risk, as this information can be combined with data from other breaches for use in targeted phishing attacks or social engineering tactics.

While the company's redaction of data elements in the notification sample is a standard procedure to limit the disclosure of sensitive information, it makes it difficult for customers to fully understand what risks they need to protect themselves against. The lack of clarity on whether additional information such as addresses, phone numbers, or order histories was leaked constitutes a barrier for customers in determining the scope of necessary precautions.

How Did the Attack Happen

According to the company's statements, the security breach was detected on March 23. An internal investigation revealed that the attackers gained access to certain files on the network between March 20 and March 22, a three-day window. This timeline shows that the attackers were active in the system for some time before being detected. However, no technical details have been shared about how the attack began, what security vulnerability was exploited, or the specific methods used to infiltrate the system.

OnTrac stated that it contracted a third-party cybersecurity specialist firm following the incident to determine the scope of the breach and strengthen its security infrastructure. This is a standard step taken in such large-scale incidents to conduct a root cause analysis and prevent similar future attacks. It is not yet known which hacker group is behind the attack or what their motivations were. As of now, no ransomware or data extortion group has claimed responsibility for the attack.

Who Is Affected

Those directly affected by the data breach are the customers who use OnTrac's delivery services. Given the company's extensive operational footprint reaching 70% of the U.S. population, it is estimated that the number of potentially affected individuals could be quite high. However, OnTrac has not disclosed a specific number of customers affected by the data breach. Notifications are only being sent to individuals whose data is believed to have been compromised, so there is a possibility that not every customer who used the service was affected. Nevertheless, the company's large customer base makes this incident a matter of national concern.

What Can You Do

OnTrac has taken some steps to protect its customers whose data may have been leaked. If you have received a notification letter from the company, it is recommended that you consider the following measures:

• Take Advantage of Free Credit Monitoring: The company is offering 12 months of free credit monitoring and identity protection services through a firm called CyberScout. This service provides proactive protection against identity theft by detecting and alerting you to suspicious activity on your credit reports. Note that there is a 90-day deadline to enroll in this service, as specified in the notification letter.
• Review Your Account Statements and Credit Reports: Regularly check your bank accounts, credit card statements, and credit reports for any unfamiliar or suspicious transactions and report them immediately to the relevant financial institution.
• Place a Fraud Alert: You can place a free fraud alert on your credit reports. This alert requires creditors to take extra steps to verify your identity when a new credit application is made in your name.
• Implement a Credit Freeze: If you believe the risk is high, you might consider freezing access to your credit reports entirely. A credit freeze restricts access to your credit reports until you lift it, significantly preventing fraudsters from opening new accounts in your name. This service is generally free.

What Is the Company Saying

In its notification, OnTrac provided information about the steps taken following the incident. The company stated that it took steps to "ensure the data described above was re-secured and not distributed." This statement has been carefully interpreted within cybersecurity circles. Such language often implies that an agreement was reached with the attackers, such as a ransom payment, to prevent the leaked data from being published or sold online. However, the company has not made an official statement on whether a ransom was paid.

The company also stated, "We are not aware of any fraud or publication of stolen information resulting from this incident, nor do we have any reason to believe any such misuse of information will occur." While this statement aims to reassure customers, it does not change the fact that the nature of cyberattacks means it is impossible to know for certain when or how stolen data might be used in the future. BleepingComputer reported that it had contacted OnTrac for more information about the attack, the number of affected clients, and a possible ransom payment, but had not received a response by the time of publication.

Source

https://www.bleepingcomputer.com/news/security/ontrac-notifies-customers-of-data-breach-after-network-hack/