LAPSUS$ Claims AstraZeneca Breach, Offers Alleged 3GB Data Dump
Summary
LAPSUS$ claims it accessed AstraZeneca systems and is offering an alleged 3GB data dump for sale. The group says it includes source code, cloud configurations, credentials and supply-chain data; the article provides no independent confirmation.
Key points
- LAPSUS$ claims it accessed AstraZeneca’s internal systems and is offering a compressed 3GB data dump for sale.
- The article says the group is directing potential buyers to negotiate through Session, describing a pay-to-access model.
- The alleged data includes Java Spring Boot, Angular and Python source code, plus Terraform configurations for AWS and Azure and Ansible roles.
- Reported sensitive items include private cryptographic keys, Vault credentials, and GitHub and Jenkins tokens.
- The claimed supply-chain data includes SAP integrations, forecasting, inventory tracking and OTIF delivery metrics.
- The breach and data contents are attributed to LAPSUS$ and are not independently confirmed in the article.
Article Details
- Victim Organization
- AstraZeneca plc
- Incident Type
- Alleged unauthorized access and data breach, with an internal data dump reportedly offered for sale.
- Data Types Exposed
- Source code
- Cloud infrastructure configurations
- Private cryptographic keys
- Vault credentials
- GitHub and Jenkins authentication tokens
- Supply-chain data, including forecasting, inventory tracking, SAP integrations, and OTIF delivery metrics
- Affected Data Size
- A 3GB compressed data dump is claimed to be for sale; the contents and size have not been independently confirmed in the article.
- Operational Impact
- Not reported.
- Ransom Or Extortion
- The group reportedly offered the data for sale through a pay-to-access model and directed potential buyers to negotiate via Session. The article does not report a ransom demand to AstraZeneca.
- Claim Status
- claimed
Threat Actors
Products
AWSCloud infrastructure artifacts listed include Terraform configurations for AWS and Azure and Ansible automation roles.AzureCloud infrastructure artifacts listed include Terraform configurations for AWS and Azure and Ansible automation roles.GitHubSensitive items reportedly include private cryptographic keys, Vault credentials, GitHub and Jenkins tokens, and supply-chain data such as SAP integrations and OTIF metrics.JenkinsSensitive items reportedly include private cryptographic keys, Vault credentials, GitHub and Jenkins tokens, and supply-chain data such as SAP integrations and OTIF metrics.SAPSensitive items reportedly include private cryptographic keys, Vault credentials, GitHub and Jenkins tokens, and supply-chain data such as SAP integrations and OTIF metrics.Sessionappears to be shifting to a pay-to-access model and is instructing potential buyers to negotiate via the Session messaging app; the archive allegedly contains source code, cloud configurations, secrets, andVaultSensitive items reportedly include private cryptographic keys, Vault credentials, GitHub and Jenkins tokens, and supply-chain data such as SAP integrations and OTIF metrics.