Unknown actor steals 69GB of SQL backups from government agency in under 30 minutes

En bref

• An unknown operator breached a government agency and removed SQL Server backups.
• About 69GB left the environment in under 30 minutes.
• The stolen data included migrant worker information.
• No CVE was linked to the incident, pointing to access or configuration weaknesses.
• Backup storage, egress monitoring, and credential controls need urgent review.

An unidentified operator gained access to a government agency and removed 69GB of Microsoft SQL Server backup files in less than half an hour, according to the incident facts. The stolen backups reportedly contained information about migrant workers, turning a backup-theft event into a potential privacy and compliance incident. No CVE has been associated with the activity, which suggests the entry point and exfiltration path may have involved credentials, misconfigured access, or weak controls around backup storage rather than a specific software flaw.

The affected organization is a public-sector body, and the data set includes records belonging to a vulnerable worker population. Because backups often hold full database copies, they can be as sensitive as production systems—sometimes more so, since they may be stored with broader access and less monitoring. A 69GB transfer completed in under 30 minutes also implies substantial network throughput and likely automated or scripted collection rather than manual browsing.

Why this matters: backup repositories are frequently overlooked in security programs. If an attacker can reach them, they can bypass application-level controls and take entire data sets at once. For a government agency, the exposure of migrant worker information raises notification, legal, and reputational concerns, even without a known software vulnerability.

What to watch: unusual outbound transfers from database or backup segments, service-account logins outside normal patterns, changes to backup destinations, and access from unfamiliar hosts. Teams should preserve SQL Server, storage, and network logs, then correlate the 30-minute window with authentication and egress records. The absence of a CVE does not mean the incident is low risk; it shifts focus to identity, configuration, and monitoring gaps.

À faire maintenant

1. Immediately rotate credentials for SQL Server service accounts, backup jobs, and storage access; revoke unused or shared accounts.
2. Audit backup storage permissions and network exposure, removing public or broad access and placing repositories behind private endpoints.
3. Review firewall, proxy, and NetFlow logs for large outbound transfers around the incident window and preserve all relevant evidence.
4. Enable encryption for backups at rest and in transit, and require MFA for administrative access to database and backup systems.
5. Segment backup infrastructure from general user and application networks, applying least privilege and restricting backup destinations.
6. Check SQL Server backup job schedules, destinations, and recent configuration changes for unauthorized modifications.
7. Engage privacy and legal teams to assess exposure of migrant worker records and determine notification obligations.

Source originale

Dark Reading