The Parker-Hannifin Corporation announced a data breach which exposed the personal information of employees after the Conti ransomware gang began publishing allegedly stolen data last month.
Ohio-based corporation, Parker, which has a revenue of $15.6 billion, is specialized in advanced motion and control technologies, with a strong focus in aerospace hydraulic equipment. It employs over 58,000 people.
According to Parker-Hannifin, a security incident occurred between March 11 and March 14, 2022, and it involved a third party who gained unauthorized access to Parker’s computer systems.
After being aware of the incident, Parker’s IT team immediately activated its incident response protocols, which included shutting down certain systems. The company then launched an investigation with the help of a forensic investigation firm and other third-party cyber security and incident response professionals.
Following the investigation it was determined that threat actors had exfiltrated specific files from the firm’s computers. Parker informed the law enforcement authorities regarding the data breach.
On reviewing the stolen files, Parker determined that stolen data included information related to current and former employees enrolled in Parker’s Group Health Plans and their dependents.
The information that was compromised includes details such as full name, Social Security Number (SSN), date of birth, home address, driver’s license number, U.S. passport number, financial account information (bank account and routing numbers), online account username and password, health insurance plan member ID number and health insurance dates of coverage.
The exposed information includes dates of service, health provider info, claims data, and clinical treatment details for a small subset of employees.
Using these details, it is possible for a threat actor to carry out phishing attacks, social engineering, or even identity theft and bank fraud.
Parker is covering all impacted employees and beneficiaries with a two-year membership in identity protection services via Experian.
As the incident impacts current and former employees, their dependents, and employees and beneficiaries of subsidiaries, the number of the affected individuals could be more than the company’s current workforce.
The Conti ransomware group claimed responsibility of the breach on April 1, 2022, and they published 3% of the data that they allegedly stole during their attack. Later they published the entire 419GB data set on April 20.
Parker-Hannifin designs and manufactures aerospace components, including hydraulic assemblies and fuel systems for Airbus, Boeing, Sikorsky, Rolls-Royce, Lockheed Martin, and the Commercial Aircraft Corporation of China.
It is not known whether the ransomware gang accessed technical data or if the breach was limited to employee details alone.
