Hackers Hit Cybersecurity Insurance Co Chubb

Cybersecurity insurance company Chubb, which provides aid to companies affected by data breaches, has been hit by one itself, according to a report by TechCrunch.

The company said it was looking into a “security incident” that involved unauthorized access with a third-party company.

Jeffrey Zack, a spokesperson for the company, said there was “no evidence” that the breach had hit the company’s own network, adding that it was “fully operational.” Zack did not say anything beyond that.

Threat Analyst Brett Callow, who works at a different security firm called Emsisoft, said the incident in question came from Maze, a ransomware group. The group steals data, and its ransomware spreads through a network and infects every computer it comes into contact with.

The group’s malicious software also takes the data and puts it on an external server, where it’s held until payment. If a victim doesn’t pay, then the stolen files are published online.

The FBI has known about the group and its attacks for a while, TechCrunch reported, citing CyberScoop. In December, it warned companies about the threat.

“From its initial observation, Maze used multiple methods for intrusion, including the creation of malicious look-a-like cryptocurrency sites and malspam campaigns impersonating government agencies and well-known security vendors,” the FBI advisory said.

Callow said the malicious actors posted something on their website about the Chubb attack earlier this month. They also listed the personal information of three higher-ups in the company, which include Chubb CEO Evan Greenberg.

So far, Maze has not published any files.

The attack is eye-opening because Chubb is one of the largest cybersecurity companies in the country, and it trains other companies in how to deal with hacks and data breaches.

Last year, retailer Target filed a lawsuit against Chubb for $74 million, saying the company didn’t compensate it a 2013 data breach involving data from 110 million customers, according to TechCrunch.