The Parker-Hannifin Corporation confirmed a data breach that exposed workers’ personal information after the Conti ransomware group began posting supposedly stolen information last month. Parker is an Ohio-based company specializing in innovative motion and control technology, with a particular emphasis on aircraft hydraulics. It generates $15.6 billion in revenue and employs approximately 58,000 people.
According to Parker-Hannifin, a security issue occurred between March 11 and 14, 2022. It included a third party gaining illegal access to Parker’s computer systems. After discovering that threat actors had exfiltrated particular files from the firm’s servers, the company notified law enforcement authorities of the data breach right away.
“Upon learning of this incident, Parker’s IT team immediately activated its incident response protocols, which included shutting down certain systems,” as per the firm’s notice. “Parker then launched an investigation with the assistance of a forensic investigation firm and other third-party cyber security and incident response professionals.”
After examining the stolen files, Parker discovered stolen data pertaining to current and past workers participating in Parker’s Group Health Plans, as well as their dependents. The following details were exposed as part of the data breach:
- Full name
- Date of birth
- Home address
- U.S. passport number
- Driver’s license number
- Social Security Number (SSN)
- Online account username and password
- Financial account information (bank account and routing numbers)
- Health insurance plan member ID number
- Health insurance dates of coverage
Dates of service, claims data, health provider information, and clinical treatment details for a small group of employees were all exposed. Malicious actors might use the following information to carry out phishing attacks, social engineering, identity theft, and bank fraud. As a result, all impacted workers and beneficiaries will get a two-year subscription to Experian’s identity protection services.
Given that the event affects current and past workers, their dependents, as well as subsidiaries’ employees and beneficiaries, the number of people affected might be significantly more than the company’s current staff.
Though Parker-Hannifin did not say who attacked them in April, the Conti ransomware organization claimed credit on April 1, 2022, when it released 3% of the data they purportedly acquired during their operation. On April 20, the complete 419GB data collection was published, indicating that ransom discussions had either failed or never happened.
It’s unclear whether Conti gained access to technical data or whether the breach was confined to personnel information at this moment, although comparable data has been taken in past hacks. When contacted by email to find out how many people were affected and whether technical data was also taken, a Parker-Hannifin spokesperson refused to comment.
