Top Highlights
- Checkout.com refused to pay the ransom after a high-profile attack by ShinyHunters, instead donating the demanded funds to cybersecurity research at universities.
- The breach was traced to a legacy third-party cloud storage system used until 2020, which exposed internal documents but did not impact payment processing or merchant funds.
- The company acknowledged responsibility for failing to decommission outdated systems, highlighting the risks of neglected legacy infrastructure.
- The incident underscores the critical importance of properly managing and decommissioning old systems to prevent similar security vulnerabilities.
The Core Issue
Earlier this month, the online payment platform Checkout.com fell victim to a cyberattack orchestrated by the notorious extortion group ShinyHunters, who claimed to have breached a legacy cloud storage system and stolen sensitive data. Although the attackers did not gain access to payment processing or customer financial information, they demanded a ransom, which Checkout.com resolutely refused to pay, opting instead to donate the demanded sum to universities funding cybersecurity research. The breach was traced back to an outdated system last used in 2020, highlighting a critical lapse in decommissioning old digital infrastructure that left certain internal documents vulnerable. This incident, publicly acknowledged by CTO Mariano Albera, underscores the broader danger posed by neglected legacy systems, which—even if seemingly obsolete—remain potential entry points for cybercriminals, as exemplified by similar breaches in the past, such as the 2021 DNA Diagnostics Center hack.
The company’s proactive disclosure and refusal to capitulate to blackmail are seen as essential steps in maintaining trust and demonstrating industry integrity amid rising cyber threats. The incident also serves as a cautionary tale for other organizations about the importance of diligently retiring unused systems to preventing costly breaches. Industry experts, like those from The TJC Group, emphasize that neglected legacy system decommissioning is a widespread yet often overlooked cybersecurity vulnerability, capable of inflicting serious financial and reputational damage. Checkout.com’s responsible handling—contacting affected clients, collaborating with law enforcement, and channeling ransom funds into academic cybersecurity research—illustrates a strategic approach to coping with such incidents, while also reminding the industry of the ongoing need to secure all digital assets, anew and outdated alike.
What’s at Stake?
The breach involving ShinyHunters compromising Checkout.com’s legacy cloud storage system exemplifies a peril that any business relying on outdated or inadequately protected cloud infrastructure faces, threatening to cause severe operational disruption, financial loss, and erosion of customer trust; as cybercriminals exploit vulnerabilities in legacy systems—often characterized by weak security protocols or insufficient updates—your organization could experience data breaches that expose sensitive customer information, halt critical transactions, incur costly legal liabilities, and ultimately compromise your reputation, demonstrating that complacency in maintaining robust, modern security measures leaves your enterprise vulnerable to the very threats that have compromised even major players like Checkout.com.
Fix & Mitigation
Timely remediation is crucial in addressing security breaches like the ShinyHunters compromise of Checkout.com’s legacy cloud storage system. Prompt action minimizes potential damage, reduces the window for malicious activities, and helps restore trust by demonstrating an organization’s commitment to security resilience.
Assessment & Identification
- Conduct a thorough forensic investigation to determine the scope and impact.
- Identify all data and systems affected, including backups.
Containment & Eradication
- Isolate infected or compromised systems from the network.
- Remove malicious files, malware, or unauthorized access points.
Mitigation & Recovery
- Patch known vulnerabilities in legacy storage systems or disable outdated components.
- Implement enhanced access controls, such as multi-factor authentication.
- Upgrade to more secure cloud storage solutions if possible.
- Ensure data backups are recent, verified, and segregated to facilitate recovery.
Monitoring & Validation
- Increase security monitoring to detect abnormal activity.
- Validate systems’ security posture through testing and audits.
Communication & Documentation
- Notify stakeholders, regulators, and affected customers as appropriate.
- Document all actions taken for accountability and future reference.
Stay Ahead in Cybersecurity
Stay informed on the latest Threat Intelligence and Cyberattacks.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1cyberattack-v1-multisource
