Bose reveals it suffered “a sophisticated cyber-attack that disrupted some of its systems” in the United States.

Ransomware attacks are the new normal. From laptop manufacturer Acer to Colonial, the largest fuel pipeline in the United States, no one is protected from this ever-growing threat. Its latest victim is The audio equipment manufacturer giant Bose.

Bose has confirmed that it was a victim of a ransomware attack and experience a data breach on 7 March 2021, which impacted its US systems.

The incident was revealed in a letter [PDF] the company last week sent to the Attorney General at the New Hampshire Consumer Protection Bureau in which its legal representative stated that Bose did experience a “sophisticated cyber-incident.”

The incident reportedly “resulted in the deployment of malware/ransomware across [its] environment.”

Evidence of Data Exfiltration Not Found 

As soon as the attack was discovered, Bose launched the necessary incident response protocols, including activating its technical team to prevent further spread of the malware and strengthening its defenses against “unauthorized activity.”

In April, the company’s investigating team learned that hackers had stolen HR data related to six of its ex-New Hampshire employees and “threat actor interacted with a limited set of folders.”

The data included social security numbers, employee names, and compensation data. However, they didn’t find any evidence that the data was or wasn’t “successfully exfiltrated.

The company has contacted the FBI for further investigation.

In early March 2021, Bose experienced a sophisticated cyber-attack that disrupted some of our systems. Based on our investigation and forensic analysis, Bose determined, on April 29, 2021, that the perpetrator of the cyber-attack potentially accessed a small number of internal spreadsheets with administrative information maintained by our Human Resources department, the letter stated.

These files contained certain information pertaining to employees and former employees of Bose. We understand this may be of concern. At this time, through our ongoing monitoring activities and investigative work, we have no evidence that this information has been misused or disseminated by third parties, claimed the company.

The data elements affected by the cyber-attack include your name, Social Security Number, compensation information, and comparable HR-related information, Bose revealed.

The Bose data breach is the latest wake-up call for businesses. It serves as another reminder that criminal hackers are increasingly taking advantage of the upheaval to corporate working practices caused by the pandemic. As more businesses embrace hybrid work models, where staff split their time between the home and the office, weak security systems will likely continue to come under attack.