Cabot Debt Collectors - hacked - personal data of people in arrears

Brendan Burgess

Founder
Messages
54,673

Website of major debt-collection agency disabled in IT outage

A leading debt-collection agency has been hit with an IT outage that has crippled its systems for days.
www.independent.ie

A leading debt-collection agency has been hit with an IT outage that has crippled its systems for days.
Cabot Financial carries out debt collection on behalf of banks and credit unions in this country. It also bought distressed mortgages in the past. Its website has been disabled by the outage.
A message on the site states: “We are currently experiencing technical difficulties and you may not be able to contact us. For mortgage customers, our telephone lines are now operational. You may experience longer than usual wait times to speak with our agents.
 
There is another aspect to this. IT outages that go on for days are often coupled with unauthorised third party access to the systems in question. The ransomware attack on the HSE is probably the best known.

Was this a ransomware attack?
Were Cabot's IT systems hacked?
If so, has the Data Protection Commissioner been informed?
Has people's personal information that was stored on Cabot's systems been leaked?

There seems to be silence from Cabot on the above. They don't appear to have responded to queries from the Irish Examiner and the Irish Independent.
 

Hackers may have access to personal details of thousands of customers after debt collection firm attacked

The data breach at one of the State’s largest debt-collection agencies may mean hackers have access to the financial and personal details of thousands of consumers it is dealing with.
www.independent.ie

Cyber attack confirmed.
 
Cabot got a court order against a UK web hosting company which appears to be based at an accommodation address

Cyberattack on debt acquisition firm Cabot involved theft of 394,000 data files, court hears

Cabot Financial claims there are ‘persons unknown’ behind the attack
www.irishtimes.com

Last month, Cabot was granted an injunction requiring Aeza and the “persons unknown” to deliver up some 356 GB of data initially removed from Cabot’s IT system between September 17th and 18th last.

...

Mr Web said Mandiant had concluded that the IP address is associated with Aeza which has an address in Barking Road, London. From a Google Street View search, it appears to be the office of another firm that merely provides secretarial services to Aeza, he said.

The only director of Aeza is Marat Timurov, with an address in Uralsk, Kazakhstan. Aeza’s website describes it as a web-hosting provider and it has a UK contact number and an email address

...

Cabot has more than 100,000 current customers and if the data stolen included historic customers, it could be multiples of that figure, Cabot director Sean Webb said in an affidavit.
 
The use of the word 'removed' is interesting. It insinuates that data was also deleted/encrypted on Cabot's systems, rather than just 'backed up' (copied) to an IP address allocated to Aeza.
They now want the data 'returned', rather than simply deleted/destroyed.
 
I got informed by them of a breach in relation to a settlement agreed with a former client

So on top of the breach the breached it again by coming to me and not their former client
 
RichInSpirit said:
As a historical "customer" of Cabot how do I check if my data has been stolen, abused etc.?
Click to expand...
I would assume that your data has been stolen.

The affidavit submitted to the High Court said that 393,984 files totalling 356.65GB of data had been removed from Cabot. There has been no mention in the media of the data being abused.

The thing to ask Cabot is, "What information did you have about me on your system?"
 

I might talk to a solicitor about it too.
 
You must log in or register to reply here.
Menu
Log in
Register