Full Report
Enzo Biochem said it settled a class action lawsuit related to a ransomware attack for $7.5 million and also is making upgrades to its data protection systems.
Analysis Summary
# Incident Report: Enzo Biochem Ransomware Attack and Data Exfiltration
## Executive Summary
Enzo Biochem suffered a ransomware attack in April 2023 that resulted in the unauthorized access and acquisition of clinical test information and personal data from nearly 2.5 million individuals. The initial unauthorized access was attributed to the use of reused, shared, and old employee login credentials without multi-factor authentication. The impact included a significant data breach involving sensitive PII and regulatory scrutiny, ultimately leading to a $7.5 million settlement in a class-action lawsuit and a prior $4.5 million multi-state settlement.
## Incident Details
- Discovery Date: April 11, 2023
- Incident Date: Began prior to April 11, 2023 (Approx. April 2023)
- Affected Organization: Enzo Biochem
- Sector: Biotech / Healthcare Diagnostics
- Geography: Not explicitly stated, but an investigation was led by NY OAG.
## Timeline of Events
### Initial Access
- Date/Time: Undisclosed, prior to April 11, 2023.
- Vector: Compromised employee login credentials.
- Details: Attackers accessed Enzo’s networks using two employee login credentials; one of these credentials had not been changed in ten years.
### Lateral Movement
- Details: The article does not explicitly detail lateral movement, but the successful access suggests movement occurred to facilitate data collection prior to the identified data exfiltration window.
### Data Exfiltration/Impact
- Details: Unauthorized access/acquisition of clinical test information and personal data for approximately 2,470,000 individuals. This included names, test information, and approximately 600,000 Social Security numbers.
### Detection & Response
- Date/Time: April 11, 2023 (Date of discovery/acknowledgment).
- Details: An investigation was subsequently led by New York’s Office of the Attorney General (OAG). The company maintained operations despite the attack. The company committed to and implemented system upgrades to data protection systems.
## Attack Methodology
- Initial Access: Compromise of two employee login credentials.
- Persistence: Not explicitly detailed, but implied by the duration of data access.
- Privilege Escalation: Not explicitly detailed.
- Defense Evasion: Not explicitly detailed, but the lack of MFA enabled evasion of basic access controls.
- Credential Access: Theft or reuse of existing, poorly managed credentials.
- Discovery: Not explicitly detailed.
- Lateral Movement: Not explicitly detailed.
- Collection: Gathering clinical test information and personal data (names, SSNs).
- Exfiltration: Exfiltration of the collected sensitive data.
- Impact: Ransomware deployment leading to data exposure and subsequent financial/legal repercussions.
## Impact Assessment
- Financial: $7.5 million class-action settlement; $4.5 million settlement paid to three state governments.
- Data Breach: Data exposure for ~2.47 million individuals, including ~600,000 Social Security numbers, names, and clinical test information.
- Operational: The company was able to maintain operations.
- Reputational: Significant backlash leading to class-action litigation and regulatory settlements.
## Indicators of Compromise
* (No specific IOCs like IP addresses or hashes were provided in the source text.)
- Behavioral indicators: Successful logon using credentials lacking MFA for remote email access.
## Response Actions
- Containment: Implied by the discovery date, but specific initial containment steps are not detailed.
- Eradication: Not explicitly detailed, but implied by subsequent system upgrades.
- Recovery: Committed to and implemented "certain upgrades to its data protection systems." Managed subsequent legal and regulatory fallout.
## Lessons Learned
- Poor credential hygiene significantly heightens cyber risk; one compromised credential had not been updated in ten years and was shared among multiple employees.
- The absence of multi-factor authentication (MFA) for remote access, especially for email, served as a critical failure point for initial access control.
## Recommendations
- Immediately implement and enforce Multi-Factor Authentication (MFA) for all remote access protocols, especially corporate email.
- Establish stringent policies for password rotation and usage, ensuring that shared or decade-old passwords are eliminated.
- Conduct thorough network architecture reviews to segment sensitive data environments and limit the potential blast radius of future compromises.