News: 1625048706

Exclusive Criminals infected the Salvation Army in the UK with ransomware and siphoned the organisation's data, The Register has learned.

A Salvation Army spokesperson confirmed the evangelical Christian church and charity was compromised, and said it alerted regulators in the UK. She told us:

“We are investigating an IT incident affecting a number of our corporate IT systems. We have informed the Charity Commission and the Information Commissioner’s Office, are also in dialogue with our key partners and staff and are working to notify any other relevant third parties.”

[1]

She continued: “We can also confirm that our services for the vulnerable people who depend on us are not impacted and continue as normal.”

[2]

[3]

The Salvation Army refused to give any further information, such as the identity of the criminal attackers, or the volume and type of data accessed by the them. To date, nothing has emerged on known ransomware gang sites.

Sally Army staff and volunteers should keep a close eye on bank statements for mysterious transactions, and for correspondence suggesting new accounts have been opened with financial service providers. Ransomware gangs typically resell stolen information to other criminals for further exploitation.

[4]

Jake Moore, a cyber security specialist with Slovakian antivirus firm ESET, told The Register : “It is vital that those who could be at risk are equipped with the knowledge of how to mitigate further attacks. The first few days and weeks after a breach are the most important, as criminals will be quick to take advantage of the situation and strike while they still can.”

The Reg was told by sources that the Salvation Army first became aware of the attack around a month ago, which we are told affected a London data centre used by the organisation.

Army reserves

According to its [5]full accounts for the year 2020 the two charity trusts registered by the UK arm of the org registered revenues of £240.822m and £160.4m respectively.

Fund balances brought forward for the SA Trust were £631.16m as of 31 March 2020 and for the SA Social Work Trust, general reserves amounted to £8.2m.

The UK arm of the charity - which has branches worldwide - calls itself "the largest provider of welfare services in the UK after the government". The Salvation Army won a [6]£280m 2020 Modern Slavery Victim Care Contract with the Home Office last year. Under the deal, the SA provides "accommodation, support and assistance to potential victims of modern slavery and human trafficking to assist in their recovery" from June 2020 until June 2028.

It also does public sector work in other countries, notably France, Canada and the US. [7]Forbes estimates it as the fourth largest charitable org in the US, with annual revenues of $3.3bn, $2.2bn of which is privately donated.

Home working

In 2018, the Salvation Army in the UK [8]told Charity Digital it had replaced its PC-based network with a Citrix Virtual Desktops system, allowing workers to connect to its IT system securely from a range of devices, including Dell Qyse thin-client terminals set up for home working.

“Those who may believe they have had their details taken ... must contact their banks to add extra fraud protection and to be on guard for extra attempts such as unsolicited calls or emails phishing for extra information,” added ESET’s Moore.

Other infosec industry sources suggested that the Conti or Pysa ransomware gangs might have been behind the attacks. Conti was the strain of ransomware deployed by the WizardSpider gang, who perpetrated [9]the Irish Health Service attack , which came within a whisker of paralysing Irish hospitals as staff were forced to fall back to paper-based processes from the pre-computer era.

Pysa, meanwhile, has been seen [10]targeting schools and other such “soft underbelly” targets — and was also [11]the criminal crew behind the Hackney Council hack late last year.

[12]

An ICO spokesperson confirmed the Salvation Army had reported an incident to it and told us: “People have the right to expect that organisations will handle their personal information securely and responsibly. If an individual has concerns about how their data has been handled, they should raise it with the organisation first, then report them to us if they are not satisfied with the response.”

The Charity Commission told us: “In line with our guidance, the charity has submitted a serious incident report in relation to this matter. We are currently assessing this information and cannot comment further at this time.”

If you would like to contact The Register about this story, [13]here is how . ®

Get our [14]Tech Resources



[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YNyVJfrmrhSxafmXzoFXywAAAIc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNyVJfrmrhSxafmXzoFXywAAAIc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YNyVJfrmrhSxafmXzoFXywAAAIc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNyVJfrmrhSxafmXzoFXywAAAIc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://www.salvationarmy.org.uk/about-us/annual-review-and-accounts

[6] https://www.contractsfinder.service.gov.uk/notice/247ccd4d-b43a-497d-8573-d869f2ae4680?origin=SearchResults&p=1

[7] https://www.forbes.com/lists/top-charities/#6c56f5155f50

[8] https://charitydigital.org.uk/topics/topics/the-salvation-army-boosts-remote-working-5383

[9] https://www.theregister.com/2021/05/14/ireland_hse_ransomware_hospital_conti_wizardspider/

[10] https://blog.malwarebytes.com/threat-spotlight/2021/03/pysa-the-ransomware-attacking-schools/

[11] https://www.theregister.com/2020/10/13/hackney_council_hacked_hackers_cyberhack/

[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YNyVJfrmrhSxafmXzoFXywAAAIc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[13] https://www.theregister.com/Profile/contact/

[14] https://whitepapers.theregister.com/