Two Tirol Companies Recount EGLO Ransomware Attack and Localmind Intrusion

Article Details

Victim Organization

EGLO (Eglo Leuchten) and Localmind GmbH

Victim Domain

Unknown

Incident Type

EGLO: ransomware attack following use of stolen Citrix account credentials. Localmind: intrusion into an externally accessible beta instance and connected automation environment, followed by access to infrastructure information and a CRM database; the attacker also allegedly created fake social media profiles and attempted access to executives' private accounts.

Incident Date

2022-07-18

Data Types Exposed

• EGLO reported that no sensitive or business-critical data was stolen.
• Localmind customer contacts in a CRM database were accessible to the intruder; the investigation found no evidence of systematic data exfiltration.

Affected Records

Not disclosed

Affected Data Size

Not disclosed

Operational Impact

EGLO: 140 of 180 servers and 500 of 1,800 devices were affected; deliveries stopped for ten days. SAP was restored after ten days, and 99% of systems were stable after three weeks. Data was restored from backups. Localmind: its cloud infrastructure was affected, and more than 150 customers were contacted. The article reports no disruption or compromise of customers' on-premises environments.

Ransom Or Extortion

EGLO attackers encrypted data, left ransom notes, and demanded payment; EGLO did not pay. Localmind's attacker did not encrypt data or demand a ransom, but sent a memorandum to company stakeholders, political parties, media, and prospective customers. Localmind described the conduct as indicating destructive intent; the identity and motive of the attacker were not established.

Claim Status

confirmed