Ransomware Struck Another Pipeline Firm—and 70GB of Data Leaked

When ransomware hackers hit Colonial Pipeline last month and shut off the distribution of gas along much of the East Coast of the United States, the world woke up to the danger of digital disruption of the petrochemical pipeline industry. Now it appears another pipeline-focused business was also hit by a ransomware crew around the same time, but kept its breach quiet—even as 70 gigabytes of its internal files were stolen and dumped onto the dark web.

A group identifying itself as Xing Team last month posted to its dark web site a collection of files stolen from LineStar Integrity Services, a Houston-based company that sells auditing, compliance, maintenance, and technology services to pipeline customers. The data, first spotted online by the WikiLeaks-style transparency group Distributed Denial of Secrets, or DDoSecrets, includes 73,500 emails, accounting files, contracts, and other business documents, around 19GB of software code and data, and 10GB of human resources files that includes scans of employee driver’s licenses and Social Security cards. And while the breach doesn’t appear to have caused any disruption to infrastructure like the Colonial Pipeline incident, security researchers warn the spilled data could provide hackers a roadmap to more pipeline targeting. LineStar did not respond to requests for comment.

DDoSecrets, which makes a practice of trawling data leaked by ransomware groups as part of its mission to expose data it deems worthy of public scrutiny, published 37 gigabytes of the company’s data to its leak site on Monday. The group says it was careful to redact potentially sensitive software data and code—which DDoSecrets says could enable follow-on hackers to find or exploit vulnerabilities in pipeline software—as well as the leaked human resources material, in an effort to leave out LineStar employees’ sensitive, personally identifiable information.

But the unredacted files, which WIRED has reviewed, remain online. And they may include information that could enable follow-on targeting of other pipelines, argues Joe Slowik, a threat intelligence researcher for security firm Gigamon who has focused on critical infrastructure security for years as the former head of incident response at Los Alamos National Labs. While Slowik notes it’s still not clear what sensitive information might be included in the leak’s 70GB, he worries that it could include information about the software architecture or physical equipment used by LineStar’s customers, given that LineStar provides information technology and industrial control system software to pipeline customers.

“You can use that to fill in lots of targeting data, depending on what’s in there,” says Slowik. “It’s very concerning, given the potential that it’s not just about people’s driver’s license information or other HR related items, but potentially data that relates to the operation of these networks and their more critical functionality.”

Xing Team is a relatively new entrant to the ransomware ecosystem. But while the group writes its with a Chinese character on its dark web site—and comes from the Mandarin word for “star”—there’s little  reason to believe the group is Chinese based on that name alone, says Brett Callow, a ransomware-focused researcher with antivirus firm Emsisoft. Callow says he’s seen Xing Team  use the rebranded version of Mount Locker malware to encrypt victims’ files, as well as threaten to leak the unencrypted data as a way to extort targets into paying. In the case of LineStar, Xing Team appears to have followed through on that threat.

That leak could in turn serve as a stepping stone for other ransomware hackers, who frequently comb dark web data dumps for information that can be used to impersonate companies and target their customers. “If you were to steal data from a pipeline company that could possibly enable you to construct a fairly conventional spearphishing email to another pipeline company,” says Callow. “We absolutely know that groups do that.”