Faxinating Solutions, a Québec company specializing in electronic data interchange (EDI), was targeted by a cybercriminal group. On March 16, the Conti group published confidential documents, which it claims to have stolen from the company, on its site hosted on the “dark web.”
Reached by phone, owner and CEO Steve Hatajlo told us that he “cannot deny that an incident took place.” The company, along with the relevant authorities, is “monitoring the situation closely.” According to a report published on the FreightWaves website, the breach was discovered on March 3 and the entry point was a phishing email.
Faxinating Solutions provides software tools that allow businesses to transfer data from one format to another. EDI thus makes it possible to share electronically information that was once available only on paper, such as purchase orders or invoices. Its clients include big names in transportation and retail, such as Metro, Walmart, Colabor and others.
The company’s website states that it offers a web portal for suppliers of the Ministère de la Santé et des Services sociaux (MSSS, Québec’s health and social services ministry). This service is reportedly not offered directly, but through a partner. In response to our request for information, an MSSS spokesperson said that “this supplier has no contracts or business relationships with the Ministère de la Santé et des Services sociaux and no cyberattack has been recorded.” Following a request for clarification, the MSSS public affairs department told us that “some institutions in the health and social services network have suppliers that subcontract with this company. The company holds no information belonging to the MSSS or its institutions. However, we continue to monitor the situation.” Mr. Hatajlo assured us that Faxinating Solutions does not process any medical data or confidential patient information.
Ransomware attacks are growing, and this incident reminds us that companies offering IT solutions are prime targets for criminal groups.
This article was updated after its initial publication to include the clarification received from the MSSS.
