Ransomware Victims' Data Published via DDoSecrets

A group of data activists called Distributed Denial of Secrets (DDoSecrets) has begun publishing a massive amount of corporate information leaked by ransomware operators on the Dark Web.

So far DDoSecrets has shared 1TB of information with at least 750,000 emails, photos, and documents from five organizations, Wired reports. It's also offering to privately share an additional 1.9TB from more than 12 other companies with reporters or academics. The data spans industries including pharmaceuticals, finance, software, manufacturing, real estate, retail, and oil and gas.

All of this information comes from ransomware operators who, in addition to encrypting their victims' machines and demanding payment, steal their targets' data and threaten to publish it online if ransom is not paid. Consequently, troves of this data end up on the Dark Web, where they're shared among criminals and security researchers.

Emma Best, co-founder of DDoSecrets, tells Wired the data that ransomware operators share online often contains content that warrants further scrutiny and sometimes public disclosure. While they could not specify the type of corporate secrets these data dumps might hold given the sheer volume of information, Best says "ignoring valuable data that can inform the public about how industries operate isn't something we can afford to do."

In DDoSecrets' view, data containing evidence of corporate wrongdoing or intellectual property that could benefit the public should be available to researchers, journalists, and academics who can learn from it. Security experts, including Recorded Future analyst and researcher Allan Liska, say their practice is taking advantage of companies that have been targeted with a crime. 

Read more details in the full report here.