Maze Ransomware operators allegedly steal 10TB worth of data from Canon

Canon has been subjected to a ransomware attack impacting various services, including email from Canon, Microsoft Teams, the US website, and other internal applications.

On Canon’s image.canon cloud picture and video storage service, people have been monitoring a suspected error resulting in data loss for users of their free 10GB storage function.

On July 30th, 2020, the image.canon site experienced an outage and the site would display updates of status for six days before it went back into operation yesterday, August 4th.

The final status report, however, was odd because it states that while data was lost, “there was no image data leakage,” which made us believe they fell victim to a cyber attack or ransomware attack.

Source: BleepingComputer

‍

A source contacted BleepingComputer and shared an screenshot of a company-wide notification entitled ‘Message from IT Service Center’ which was sent from Canon’s IT department at approximately 6 AM this morning. This warning states that Canon is experiencing “wide ranging device issues that may not be apparent at this time affecting numerous applications, Staff, Email and other systems.”

As part of this outage, the website of Canon USA now contains bugs, or page bugs that are not noticed when viewed.

Source: BleepingComputer

The list of Canon domains that appear to be affected by this outage, include:

www.canonusa.com
www.canonbroadcast.com
b2cweb.usa.canon.com
canondv.com
canobeam.com
canoneos.com
bjc8200.com
canonhdec.com
bjc8500.com
usa.canon.com
imagerunner.com
multispot.com
canoncamerashop.com
canoncctv.com
canonhelp.com
bjc-8500.com
canonbroadcast.com
imageland.net
consumer.usa.canon.com
bjc-8200.com
bjc3000.com
downloadlibrary.usa.canon.com
www.cusa.canon.com
www.canondv.com

Maze Ransomware Operators claims to have stolen 10TB of data from Canon

After contacting the ransomware operators, Maze informed BleepingComputer that their assault was carried out this morning as part of the attack on Canon when they stole “10 terabytes of data, private databases, etc ..”

Maze refused to share any additional information about the attack including the amount of ransom, evidence of data stolen and the number of devices encrypted.

Although it was first assumed that the ransomware attack was linked to the image.canon failure, Maze stated that it was not triggered by them.

Maze is a company-targeted human-operated ransomware that exploits and spreads stealthily laterally across a network until it gains access to an administrator account and Windows domain controller of the system.

During this process, Maze will delete unencrypted files from servers and backups, and upload them to servers of the threat actor.

After they’ve extracted something of interest from the network and obtained access to a Windows domain controller, Maze can install ransomware to encrypt all devices throughout the network.

When a victim refuses to pay the ransom, Maze will release the stolen files of the victim to the public at a data leak site they have developed.

In the past, Maze took blame for other high profile victims, including LG, Xerox, Conduent, MaxLinear, Cognizant, Chubb, VT San Antonio Aerospace, the City of Pensacola, Florida, and more.

‍