Ankura CTIX FLASH Update - May 24, 2022

Ransomware/Malware Activity

General Motors Discloses Data Breach Follow Credential Stuffing Attack

General Motors (GM) disclosed a data breach following a credential stuffing attack that occurred in April 2022. A credential stuffing attack is an attack conducted through collections of username and password combinations previously leaked in other sites' data breaches to gain access to user accounts on a targeted website. GM revealed in their notification letter, sent out to impacted individuals on May 16, 2022, that suspicious login activity occurred between April 11 and April 29, 2022. The manufacturer confirmed that there is currently no evidence that the login credentials were obtained from GM itself and that the unauthorized threat actors behind the compromise may have gained access to limited personal information, such as "first and last name, personal email address, personal address, username and phone number for registered family members tied to [the]