Thought Leadership
A new ransomware group has published nearly 2,800 records containing the names and email addresses of Disney employees on a hacker forum.
A ransomware group calling itself WhiteArmour claims to have stolen data from entertainment giant Walt Disney. The group posted a dataset on a well-known hacker forum that it says contains Disney’s employee directory.
“We are releasing Disney’s employee directory as a small start for our group, but there is more to come.”
WhiteArmour
The group also claims to have additional victims, including Fortune 500 companies, lined up for its leak site. Disney has not yet commented on the allegations.
Names, Email Addresses, and Internal IDs
Cybernews researchers examined a sample of the allegedly stolen data. The CSV file contained nearly 2,800 records with full names, internal system identifiers, and business email addresses associated with Disney and several of its subsidiaries. According to the researchers, the records appear to be authentic.
Most of the email addresses do not belong directly to Disney but rather to companies within the group, Cybernews reported. ABC News accounts make up the largest share, while the sample also includes addresses associated with ESPN and Disney itself. The forum post does not specify how many records WhiteArmour claims to have stolen in total. The group has also not named a price. The researchers suspect that, like other ransomware operators, WhiteArmour is primarily seeking to extort affected companies directly.
Risk of Targeted Phishing Attacks
According to Cybernews, the combination of names, business email addresses, and internal identifiers could help cybercriminals craft convincing phishing messages that appear to come from colleagues or the IT department. Disney employees should be cautious when handling unsolicited messages that use real names, refer to internal workflows, or request login credentials. Little is currently known about the WhiteArmour group. According to its forum post, the Disney data release marks the beginning of its operations.
(Editorial Team)
