MarineMax, self-described because the world’s largest leisure boat and yacht retailer, is notifying over 123,000 people whose private data was stolen in a March security breach claimed by the Rhysida ransomware gang.
The corporate operates over 130 places, together with 83 dealerships and 66 marinas and storage amenities worldwide. Final 12 months, it reported $2.39 billion in income and a $835.3 million gross revenue.
Whereas the Florida-based yacht vendor initially acknowledged in a March 12 SEC submitting that no delicate knowledge was saved on the compromised methods, two weeks later, it mentioned in a brand new 8-Okay submitting that the attackers had stolen private knowledge belonging to an undisclosed variety of individuals.
This Tuesday, in breach notification letters filed with the Places of work of Maine’s and Vermont’s Attorneys Common, MarineMax revealed that the data breach impacts 123,494 people. It added that the incident was detected on March 10, ten days after the attackers gained entry to its community, and it solely impacted a “restricted” variety of methods.
“Based mostly on our investigation of the incident, we decided that an unauthorized third celebration obtained entry to the environment from March 1, 2024 to March 10, 2024,” MarineMax mentioned. “Our investigation just lately concluded, and it was decided that the unauthorized third celebration acquired a few of our knowledge, which contained your private data.”
MarineMax additionally advised the Maine and Vermont Attorneys Common that the attackers had stolen names or different private identifier data. Nonetheless, it has but to reveal what different private data was exfiltrated from its methods and if the data breach impacted each clients and workers.
Whereas the corporate did not attribute the breach to a particular menace group, and it is nonetheless describing it as a “cybersecurity incident,” the Rhysida ransomware gang claimed the assault on March 20.
The cybercriminals have since revealed a 225GB archive of recordsdata allegedly stolen from MarineMax’s community on their darkish net leak website, representing what they declare to be knowledge they could not promote.
Rhysida additionally revealed what seem like screenshots of MarineMax’s monetary paperwork, in addition to buyer or worker driver’s licenses and passports.
This comparatively new ransomware-as-a-service (RaaS) operation surfaced nearly one 12 months in the past, in Could 2023, and shortly gained notoriety after breaching the Chilean Military (Ejército de Chile) and the British Library.
The U.S. Division of Well being and Human Providers (HHS) additionally linked its associates to assaults concentrating on healthcare organizations, whereas CISA and the FBI warned that the Rhysida ransomware gang can also be behind many opportunistic assaults concentrating on organizations throughout varied trade sectors.
As an illustration, it breached Sony subsidiary Insomniac Video games in November and leaked 1,67 TB of paperwork on its leak website after the sport studio refused to pay a $2 million ransom.
Extra just lately, the Singing River Well being System warned that nearly 900,000 individuals had their knowledge stolen in an August 2023 Rhysida ransomware assault.
