Actor Claims Xtium Breach Exposed 485.8TB of Backup and Share Data
Summary
A threat actor claims to have accessed Xtium’s Veeam backups for about eight months and taken roughly 485.8TB of data, including client VM backups and Synology ShareSync files. The alleged breach and data theft are unconfirmed.
Key points
- A threat actor alleges approximately 485.8TB of data was taken from Xtium; the article provides no independent confirmation.
- The actor claims about 480TB consists of client VM backups from a compromised Veeam instance.
- The actor alleges maintaining undetected access to the backup instances for around eight months.
- The article reports an alleged second breach ten days after extortion negotiations stalled.
- The claimed data also includes client file-level restores and 5.8TB of Xtium and client TeamShares data from Synology ShareSync.
- The actor is reportedly offering stolen data for sale and soliciting clients to pay for deletion of their backups.
Article Details
- Victim Organization
- Xtium
- Incident Type
- Alleged data breach, data theft, and extortion
- Data Types Exposed
- Client virtual machine backups
- Client file-level restore data
- Internal Xtium and client TeamShares data
- Affected Data Size
- The threat actor claims approximately 485.8 TB was compromised, including about 480 TB of client VM backups and 5.8 TB of TeamShares data.
- Operational Impact
- The threat actor alleges approximately eight months of undetected access to Veeam backup instances and a second network breach ten days after negotiations stalled. No operational disruption is reported.
- Ransom Or Extortion
- The actor is reportedly selling the allegedly stolen data and soliciting Xtium clients to pay for deletion of their specific backups.
- Claim Status
- claimed
Products
Synology ShareSyncStolen data includes client file-level restores and 5.8TB from Synology ShareSync (TeamShares), and the actor is selling data and soliciting clients to pay for backup deletion.VeeamThe attacker claims eight months of undetected access to Veeam backup instances, re-breached the network after stalled negotiations, and is now selling data and offering to delete client backups for payment.