CNA Financial targeted in ransomware attack

Edward Kost
Edward Kost
July 12, 2021

CNA Financial customers are feeling the ripple effects of a ransomware attack that occurred earlier this year.

In March, CNA Financial was infiltrated by the Pheonix Locker Ransomware which is believed to be a new type of ransomware from Russian cybercriminals Evil Corp. Before deploying the ransomware, Evil Corp exfiltrated sensitive customer data.

CNA Financial sent a message to all 75,349 impacted customers to notify them of the breach.

“The investigation [of the ransomware attack] revealed that the threat actor accessed certain CNA systems at various times from March 5, 2021, to Match 21,2021. During this time period, the threat actor copied a limited amount of information before deploying the ransomware.” CNA Financial said in its breach statement.

Investigation findings also revealed that the cybercriminals accessed customer names and social security numbers. But CNA Financial assures the personal information was completely recovered before the cyberattacks had a chance to abuse it.

“...CNA was able to quickly recover that information and there was no indication that the data was viewed, retained, or shared. Therefore, we have no reason to suspect your information has or will be misused.”

This new family of ransomware may be Evil Corp’ attempt to diversify its identity to evade U.S sanctions. Since 2019, the United States Office of Foreign Assets Control (OFAC) has been on the hunt for Evil Corp and all of its subsidiaries. To sever all sources of funding to the criminal group, the OFAC prohibits ransomware negotiation firms from facilitating ransom payments to Evil Corp.

The sanctions appear to be working because Evil Corp is getting desperate. Recently, the threat actors attempted to mask its ransomware activity behind the ransomware PayLoadBin

Prior to that, the group assumed the name Gracewire for its trojan after returning from a brief hiatus to protect its leader from capture.

In 2019, the United States Government issued a $5 million reward for any information that could lead to the capture of Evil Corp boss Maksim Viktorovich Yakubets.

Even after Maksim’s capture, the financial sector will remain a prime target amongst cyberattackers. To defend against present and future threats, financial institutions need to immediately bolster their sensitive resources

How secure is CNA Financial?

CNA Financial Corporation is a financial corporation based in Chicago, Illinois, United States
  • Check icon
    View our free preliminary report on CNA Financial’s security posture
  • Check icon
    13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities
Security ratings
Abstract shape
Deliver icon

Sign up for our newsletter

Stay up-to-date on everything UpGuard with our monthly newsletter, full of product updates, company highlights, free cybersecurity resources, and more.
UpGuard customer support teamUpGuard customer support teamUpGuard customer support team

Protect your organization

Get in touch or book a free demo.
Free instant security score

How secure is your organization?

Request a free cybersecurity report to discover key risks on your website, email, network, and brand.
  • Check icon
    Instant insights you can act on immediately
  • Check icon
    Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities
Website Security scan resultsWebsite Security scan rating