Yet another healthcare provider has revealed that they were hacked by thedarkoverlord (TDO). Dr. Robert Spies, a plastic surgeon in Scottsdale, Arizona, has notified HHS and his patients of the hackers’ attempt to extort the practice. Although he does not name the hackers responsible in a notice on his web site, Dr. Spies explains: On December 10, 2018, we became aware cyber criminals gained unauthorized access to our computer network. We immediately contacted the FBI and local law enforcement authorities and have been cooperating with their investigations. We also engaged computer experts to determine if our systems and information were at risk. The investigation determined that the criminals could have viewed or accessed documents that contained patients’ personal and medical information, including names, addresses, dates of birth, procedure notes, diagnoses, medications and health insurance numbers. For a small handful of patients, the criminals could have viewed Social Security, driver’s license and/or passport numbers, if provided for verification purposes, a credit card number or financial account number, or pre-op photos. At this time, there is no evidence that patient information has been misused. His report is entirely consistent with other information DataBreaches.net had obtained about this incident. In December, thedarkoverlord had posted a notice on KickAss that said: We’ve hacked a high-end plastic surgery business located in Arizona, United States. This surgery center is owned by Doctor Robert J. Spies and operates on celebrity patients. His website is (www.azplasticsurgerycenter.com). We’ll share some of his data with yoou, since he’s refused our most handsome business proposition. Link: (link redacted by DataBreaches.net, even though it is no longer live). If you’d like to let him know how foolish he’s been, you can SMS his mobile at (redacted by DataBreaches.net) or his e-mail at (redacted by DataBreaches.net). The sample data was a 531.8 MB archive with folders containing “Dictations” (75 files), “Photos” (more than 160 photos), and “Patient ID Verification” (4 files). The Dictations folder and Photos folder contained more than one file or image for some patients, so these were not all unique patients in each folder. Many of the photos in the archive released by the hackers would permit identification of patients because in some cases, you can see the patients’ faces, and in other cases, the filenames for the photos may contain the patient’s first initial and last name. DataBreaches.net is not reproducing any of the data from the archive the hackers provided. Inspection of the meta data suggests that the newest dictation files were created December 5, 2018 and related to services or consultations conducted on November 28, 2018. As with their hack of the London Bridge Plastic Surgery Center, TDO may have hoped that people — especially celebrities — would pay good money not to have their before, during, or after pictures of plastic surgery released publicly. Whether TDO is privately trying to extort patients directly is unknown to this site, but Dr. Spies seems to have refused to pay them, and has reported the incident to law enforcement, HHS, and his patients. According to his notification to HHS, he has notified 5,524 patients.
Now THIS is very big news on thedarkoverlord front: Joseph Curtis reports that Nathan Wyatt, who was jailed on fraud charges in the U.K. but has been released from prison there, is now fighting extradition to the U.S. on charges he was involved with hacking and extorting U.S. medical entities as part of thedarkoverlord. This journalist had interviewed Wyatt exclusively prior to his first arrest in September, 2016, on charges relating to the hack and attempted sale of pictures of Pippa Middleton. Wyatt was not jailed on those charges, however, and this journalist had been told by him that the royal family had intervened so as to avert a court case that might lead to the production of embarrassing photos. Whether that is true or not, this journalist cannot say as lawyers for Wyatt did not respond to inquiries sent at the time. But Wyatt had also talked extensively with DataBreaches.net about his relationship with thedarkoverlord, which included, he said, teaching thedarkoverlord fraud techniques, and being asked by TDO to make an extortion phone call to a U.S. victim. That call (you can hear it here) was recorded and uploaded to YouTube. Wyatt subsequently linked to it in a post on the now-shuttered Alpha Bay dark web marketplace. At times, Wyatt claimed that he never actually made the call and that he just recorded it as a joke because TDO was pressuring him to do it. But if you listen to the recording, you can hear someone else at the beginning answering the phone. When Wyatt was arrested in 2016 and his devices seized, police found evidence of other crimes, including a hack of an unnamed law firm and an attempt to extort the law firm. It was on those charges that he was ultimately tried and sentenced to prison for 3 years. But law enforcement had also – according to Curtis’s reporting – found evidence that Wyatt had used his own details and live-in partner’s details to set up bank accounts in the U.K. to funnel payments to thedarkoverlord from U.S. medical entities that TDO was attempting to extort at the time. In a copy/paste error by an associate of Wyatt’s, DataBreaches.net had accidentally been shown the bank account numbers in July 2016. At that time, however, DataBreaches.net did not know that “Nathan Wyatt” was the bad actor known to her as “Crafty Cockney.” And the TDO spokesperson at the time talked about Crafty Cockney as a low-level person or associate but not one of the core people in TDO. The new charges suggest that TDO may have been downplaying Wyatt’s role, and that Wyatt’s claims of tutoring TDO and assisting in other ways may have been more accurate. So now Wyatt is reportedly fighting extradition to the U.S., it seems. According to Curtis’s reporting: He has been charged with one count of conspiracy to blackmail healthcare providers in the USA, two counts of aggravated identity theft and three counts of threatening damage to a protected computer. […] An arrest warrant was issued by the US district of Missouri on November 8th, 2017. Curtis provides a lot of other details that will sound familiar to those who have followed my reporting on thedarkoverlord since 2016. The unnamed health records management firm referred to may be Quest Health Information Management Systems. I had reported how they had been hacked by TDO in 2016, which gave TDO login credentials to Quest’s clients, including medical entities in Missouri and Georgia. The U.S. government likely has a lot of evidence against Wyatt, but for the benefit of readers who may be a bit confused by this new development, I will state here that Wyatt is almost certainly not the person who was the communicator for TDO back in June – July of 2016. How do I know that? Because I chatted with that individual while Wyatt was still being detained by law enforcement in the U.K. Then too, Wyatt’s writing, which I had ample opportunity to read in extended chats, was nowhere near the level of the individual who ran TDO’s Twitter account back then, who wrote the extortion demands and lengthy letters, and who communicated with journalists. Law enforcement may not have apprehended that first “TDO” yet. Will Wyatt appeal to the U.K. to try him there for charges relating to hacking and extorting U.S. entities because he has three children there? Probably. But there are so many victims and witnesses in the U.S. and I doubt the U.K. will find him a sympathetic figure, even if he has children. Wyatt does not have the popular support of someone like Lauri Love. As I frequently have to say when covering all things TDO: stay tuned. Note: I do not know whether the law firm that Wyatt was convicted for hacking and extorting is the same law firm involved in the 9/11 files that thedarkoverlord has recently publicized and tried to sell. It wouldn’t surprise me if it was the same law firm, but I have no proof or information either way.
Updated: After this post was published, other information became available suggesting that law enforcement may not have taken down KickAss and that the seizure notice placed on that url may have either been placed by KickAss or by some third party or parties. See updates at the bottom of this post. This is obviously a developing story. 🙂 After a few days in which thedarkoverlord did not appear in public, the criminal hackers reappeared today to release more files from 9/11. In a post on Steem, that is available on the busy.org frontend, they wrote, in part: Hello, world. As you’re well-aware, we designed a compensation plan that would allow for the public crowd-funding of our organisation in order to permit the public disclosure of our “9/11 Papers” in the interest of the public. Part of this plan was to create a tiered escalation plan that would result in multiple layers and milestones (which we’re calling checkpoints) to ensure the powers at be are being properly bent over a barrel. We’ve said it before, and we’ll say it again: we’re financially motivated, and you (the public) has spoken to us in our language (internet money, specifically Bitcoin). Remember, continuing to fund our wallet will continue to keep us motivated to help break the truth to the world by open-sourcing what we’re calling the “9/11 Papers”. To create a bit more buzz, we’ve decided to continue forward and release the decryption key for Layer 2. A quick skim of some Layer 2 files indicates that they contain a lot more of the litigation and subrogation files, but they are also starting to get into some other interesting reports relating to the FBI and CIA investigations. Those who have followed actor James Wood’s activism and tweets on Twitter will likely be interested in a file that concerns him. In January, 2002, a memo was created by Todd A. Scharnhorst of Blackwell Sanders Peper Martin that said: As a clarification to a prior memo, James Woods, a Hollywood actor, was riding in First Class with four men of Middle-Eastern dissent. He was on an American Airlines flight from Boston to Los Angeles. He thought the men were acting very suspiciously. None of them had anything to eat or drink, they did not read, sleep, nor did they appear to make themselves comfortable. They sat in their seats and stared straight ahead, occasionally “whispering something to one another with inaudible tones.” Woods thought the behavior was odd. He reported it to the flight attendants. He then reported it to the ground crew. Should this have put American Airlines on notice (should they have at least done some type of investigation into the four Middle-Eastern passengers)? As it turns out, it appears the four passengers were four of the hijackers who took over that same flight and crashed it into the World Trade Center. It appears James Woods witnessed a “dry run” of their terrorist takeover. I need to find time to do more reading in this layer. In the meantime, and in other news concerning thedarkoverlord, not only did they become the first entity ever banned from Steem (or so they tell me, but I’ve seen others who claimed to have been banned, too), but in a joint law enforcement operation, the Kickass Forum where they were posting their offerings and other information was appeared to have been seized today (see UPDATES). The notice says: THIS HIDDEN SITE HAS BEEN SEIZED as part of a joint law enforcement operation by the Federal Bureau of Investigation, ICE Homeland Security Investigations, and European law enforcement agencies acting through Europol and Eurojust in accordance with the law of European Union member states and a protective order obtained by the United States Attorney’s Office for the Southern District of New York in coordination with the U.S. Department of Justice’s Computer Crime & intellectual Property Section issued pursuant to 18 U.S.C. 983(j) by the United States District Court for the Southern District of New York So what hack or criminal activity did they allegedly conduct within the Southern District of New York? Was this a biomedical research firm? Was it Aesthetic Dentistry? Was it some victim that we may not even know about or that I’ve simply forgotten? As Bits&Digits commented on Twitter, in noting the seizure of the forum: And like that….#KickAss the forum that #tdo_h4ck3rs allegedly ran, is down and out. Now, this criminal organization has to make a choice to cut and run or play the gamble. Never a good sign to have your site seized, so much evidence. So will they cut and run or will they play the gamble? Mainstream media has not been reporting on them for the most part, Twitter banned them, Steem banned them, and now the forum that was part of their communication strategy was seized. And the fact that it was seized by order of the Southern District of New York probably means that there is a sealed complaint, too. But all that said, I don’t think we’ve seen the last of them. Update 1: AnonFiles, a file-sharing service that thedarkoverlord has used to share files from 9/11 and other hacks, is now down. Nathan Dimoff broke the news about AnonFiles on Twitter, and I just took a screenshot to confirm it: Holy crap, Batman….. there is some serious efforts afoot to stop thedarkoverlord. Stay tuned… Update 2: This is intriguing. AnonFiles is back up and Vinny Troia is claiming that the KickAss seizure notice is a fake and that KickAss just went private on another url. Other sources tell me that the seizure notice does NOT appear to be by law enforcement, but that it may not have been posted by KickAss or TDO, either. When asked about the current situation and risk to users of visiting either site, J. Tate from bits&digits told me, “I wouldnt trust anything that the intergrity seems to be compromised in. Whether or not there is evidence to support the claims at this moment. All OPSEC […]
I’ve probably reported more on the blackhats known as thedarkoverlord (TDO) than other journalists, and I’ve probably spent more time chatting with them about their work than any other journalist. But despite my considerable investment of time, there are times when I simply do not understand why they are doing what they are doing. As someone who has had decades of professional experience predicting and understanding behavior, I find that when their strategy makes absolutely no sense to me, either their neurology has led them down an unusual path, or I’m failing to appreciate some brilliance on their part. It might be either. Or both. So let me use this post to lay out what I’ve observed about TDO’s approach to amassing vast amounts of internet money (as they call it), and how it has been evolving over the past few years. In the Beginning When TDO first burst on the scene in June, 2016, it was after they had listed three patient databases with hundreds of thousands of records for sale on The Real Deal marketplace, asking exorbitant amounts of money for them. It soon became clear that the sale of the patient databases was simply a way to put pressure on their victims, who they had been attempting to extort. By placing such a high price on the data, they got media attention, and with the media attention and reporting, more pressure on their victims. But did that increased pressure convert to increased payment by the medical clinics? It didn’t appear to. Their early extortion demands, which I was privy to by virtue of having been shown many of their nonpublic email chains with their victims, did not appear immensely successful. From reading their communications, it was clear to me that TDO had done their homework: they had researched their victims and knew the names of the executives and staff, and they had even researched their victims’ families. They had also looked at patient databases closely enough to spot patient names that might belong to celebrities or famous sports figures. [Note: I am referring to TDO as “they” because it appears to be have been than one person over time and even during the same time period.] So TDO did not appear to be particularly successful in their early attempts to extort the medical sector, even though they appeared to be doing more work researching their victims than the threat actors known as Rex Mundi had done, and even though they were tweeting claims that they had been successful. More than one year later, I would learn that TDO was, indeed, doing better financially than I had imagined, as they showed me some of their wallets from 2016 and signed messages to me from the wallets. But back in the summer of 2016, TDO was not happy, to say the least. I cannot get into any details, but it almost appeared to be an obsessive battle of wills — that the victims HAD to pay or TDO would make them suffer. As brilliant intellectually as TDO seemed to be (and yes, I do think the person I was dealing with is intellectually gifted), TDO didn’t seem to really grasp how to get people to do what they wanted them to do. Doctors really do care about trying to protect patient data. Threats or reminders of the consequences of breaches aren’t really necessary or even helpful. TDO’s strategy was to increase the pressure on victims by a parade of horribles, but the victims didn’t need the parade of horribles or more motivation. As psychologist Ross Greene has famously said, “Motivation makes the possible more possible. It does not make the impossible possible.” TDO’s victims were already motivated to protect patient data, but TDO did not seem to fully recognize what was needed or helpful to convert that motivation to payment. And they couldn’t always seem to recognize situations in which they were just never going to get paid – even when doctors told them to go “F…” themselves. So there was TDO in 2016, setting ridiculously high amounts for extortion payments or for sale of databases. They didn’t care about the patients or what would happen to the patients. They cared only about getting money. Nothing else. And they didn’t seem to fully appreciate how to negotiate with healthcare professionals about protected health information. Perhaps they thought that they figured it out the following year when they began offering victims contracts that included three different payment options, but even that missed the boat. But let me digress for one minute, because to this day, people still don’t seem to understand one thing about TDO that TDO has always been extremely clear about and consistent about: they do not care about the human emotions or anguish people might feel. They only care about how to exploit human emotions if it gets them more money. From my perspective, one of the strangest – and most instructive – breaches of theirs was the Little Red Door Cancer Services of East Central Indiana hack. To this day, I’m still not totally confident that I understand what happened there because the center’s statements and TDO’s statements about “ransomware” and servers being wiped were quite different, but what really puzzled me was that they attacked a little not-for-profit. Why? This NFP had almost no money at all. Why not go after a victim that has the means to pay more? I understood that they didn’t care about the humanitarian effort, cancer, etc. But if they cared about money, why waste time on this little NFP? So that particular attack made no sense to me, and I don’t like it when things don’t make sense. By the end of 2017, though, they had also attacked a number of school districts, again leaving me wondering … why? Why attack a public school district that almost certainly will not have a lot of resources or a hefty cyberinsurance policy? Why not just go after the real commercially viable firms that are raking in tons of money? […]
Hackers claimed to have hacked hundreds of thousands of records from National Life Group, but investigation points to Sterling National Financial Group as the likely hacked entity The blackhat hacker/extortionist(s) known as thedarkoverlord (TDO) ended 2018 and welcomed 2019 with a number of bold announcements about large hacks. One of those announcements was their claim in a since-removed paste that they had hacked National Life Group (NLG) and exfiltrated more than 500,000 records from their servers: We breached National Life Group and stole over 500.000 records from their servers. They rejected our most handsome business proposition so we’re leaking a few sample documents now with more to come soon. – The hackers’ claims are disputed by NLG on a few important points. Until DataBreaches.net called NLG, they reportedly had no idea that anyone was claiming that that they had been hacked and they were not aware that anyone was trying to extort them over a hack they knew nothing about. When contacted by DataBreaches.net, their initial response could be summarized as, “What hack? What extortion attempt? We have no idea what you’re talking about.” But to understand how we got to that point, we need to back up a few weeks. A few weeks before their public claims, TDO had contacted DataBreaches.net and provided a sample of files that they claimed were from a hack of NLG. The files that DataBreaches.net received at that time are the same files that TDO recently made publicly available in a data dump that DataBreaches.net will not link to. On December 21, after a preliminary examination of the files, this journalist contacted NLG and spoke with Ross Sneyd about TDO’s claims. Sneyd denied ever having had any email communication from TDO, despite TDO insisting that they had made contact with him previously. He also denied any knowledge of any hack. I verbally provided him with some data — the names of policyholders whose names appeared in the files I had and the names and affiliations of the insurance agents who completed the applications. Sneyd informed me that they would immediately investigate the claims. Suiting action to their word, one of the things NLG immediately did was to contact FireEye’s Mandiant division for assistance in their investigation. While they pursued their investigation, this site kept digging into the files it had received, becoming less and less certain that there had been any hack of NLG. Although the files were applications for NLG policies and products, the files and the metadata all appeared to point to Texas-based Sterling National Financial Group, a firm that provides retirement and financial planning services to employees in the public marketplace. When asked to provide DataBreaches.net with more data that would prove that it was NLG that had been hacked and not Sterling NFG, thedarkoverlord declined to provide more materials. Sample Data Many of the files in the small sample this site received were confirmations that individuals had successfully applied for an insurance product. The files contained a wealth of personal and financial information such as name, postal and email address, telephone numbers (landline and cell), date of birth, Social Security number, driver’s license number (in some cases), country of birth, name of beneficiaries and their dates of birth, the applicant’s employer and job title, and bank account information including Bank name, routing number, and full account number. Note: Although TDO subsequently released theses same files to the general public unredacted, DataBreaches is redacting the files to protect the personally identifiable information. For some applicants, the files would include health information on the applicant and their minor child if they had a policy that called for term coverage: National Life Group and Sterling NFG Respond Late yesterday, DataBreaches.net received statements from both National Life Group and Sterling National Financial Group. National Life Group’s statement, below, appears to confirm what DataBreaches.net had suggested: that it wasn’t their hack: When we learned of this incident on Dec. 21 we began working with Mandiant, a leading independent digital forensics firm. Mandiant’s initial findings are that there is no evidence of a breach at National Life and this incident likely originated with an independent insurance agency. Mandiant’s work is ongoing. We understand the independent agency, which works with multiple insurance carriers, is now or will shortly be notifying the affected individuals. We are also working with law enforcement. Sterling NFG’s statement to DataBreaches.net, below, seems to acknowledge that they are responsible for notifying customers of a breach, although we might wish that their statement was a bit clearer: Sterling is aware of this incident. We are working with third party professionals to investigate the situation as well as working diligently to send notification letters to affected customers who will be eligible for credit monitoring services at no cost to them. Due to the current investigation we are unable to provide further comment. Sterling NFG declined to provide additional details so DataBreaches.net. DataBreaches.net asked thedarkoverlord to respond to NFG’s denial that they were hacked. The hackers responded: The insurance policies of the affected materials are held by National Life Group. This makes National Life Group the parent and holds responsibility over the security of the policyholders, who will now have their sensitive PII sold in droves on the dark web, due to NLG’s refusal to accept our most handsome business proposition. Who’s the Target of the “Handsome Proposition” ???? TDO declined to comment further in response to additional questions posed by this site. Their response — attempting to justify NLG paying their “handsome proposition” instead of Sterling NFG — was a bit surprising, but seems somewhat consistent with other recent statements they have made where they have attempted to hold large insurers with deep pockets such as Hicsox and Lloyd’s of London responsible for a breach that the former firm claims was actually at a law firm that had done some work for them. If this is TDO’s newer business model or approach, it doesn’t make much sense to me. Yes, I can see claiming that National Life might potentially take a reputation hit because it is their […]