As part of our regular Cyber Threat Monitoring investigations, we uncovered a data breach involving Disney on a cybercriminal forum in July.
What happened?
As we wrote in our X post, a cybercriminal group calling itself NullBulge claimed to have hacked Disney, specifically the company's internal Slack messaging system.
The group is believed to have breached Disney's systems in late June.
As a result of the breach, 1.1Tb of data was exposed to the public.
The leaked data includes nearly 10,000 channels, "every message and file possible" (as they said in their statement), unreleased projects, raw images and code, logins, links to internal web pages/APIs, etc.
At the moment Disney has not confirmed that NullBulge's claims are true, but the company released a statement saying that it “is investigating this matter.”
Was an insider involved?
NullBulge's statement suggests that the breach may have been facilitated by an insider who eventually decided to stop working with them.
The group named the individual in question in their statement, but we took the liberty of withholding the name in our tweet to protect his privacy.
What do we know about the attacker?
The NullBulge group is relatively new to our Cyber Threat Monitoring team.
Since we discovered the group's existence, we also found its blog, where NullBulge describes itself as "a hacktivist group that protects the rights of artists and ensures fair compensation for their work".
On the blog, we also found some claims of past attacks on other victims.
These attacks are still being analyzed by our team.
The group is said to be using the old leaked Lockbit builder, but this detail has yet to be confirmed.
In an email to CNN, the group claimed to be based in Russia.
According to the same email the group gained access to Disney systems through “a man with Slack access who had cookies” and targeted the company because of "how it handles artist contracts, its approach to AI, and its pretty blatant disregard for the consumer".
As always, we are closely monitoring the situation. We will provide further updates as we learn more.
Stay Cyber Safe!
