Data Breach Notification,
Data Security,
Fraud Management & Cybercrime
Bian Lian Cybercrime Group Claims Responsibility for July 2024 Attack
A Texas-based company focused on workplace drug and alcohol testing has reported that a cyberattack from July 2024 affected nearly 750,000 individuals. The breach involved The Alcohol & Drug Testing Service, which provides testing for compliance with various state and federal regulations, including those set by the Department of Transportation.
Founded in 1994, the firm, formerly known as Texas Alcohol and Drug Testing Service, has established a substantial presence through a network of certified testing sites nationwide. Though initial reports indicated the breach affected only 250 Texans, a recent submission to the Maine Attorney General’s office revealed a much larger impact, spanning 748,763 individuals, including two from Maine.
The incident, attributed to the cybercriminal group Bian Lian, was first noted on their dark web forum last summer. Upon discovering the potential compromise on July 9, 2024, TADTS immediately initiated an investigation and enhanced security measures, including changing access credentials and working with cybersecurity experts.
The investigation confirmed that an unauthorized actor had downloaded sensitive information. However, TADTS stated that as of now, there is no evidence suggesting that identity theft or related fraud has occurred due to the breach. Compromised data potentially includes names, Social Security numbers, driver’s license information, financial details, usernames, and passwords.
In addition to financial information, the breach may have affected users’ health insurance details, alien registration numbers, and biometric data. The firm has emphasized that the types of information compromised vary among the individuals impacted.
Following the attack, TADTS implemented additional security protocols and monitoring tools to safeguard against future incidents. However, the breach has already drawn the attention of several law firms, which are contemplating class action litigation against the firm.
The response from TADTS has been proactive in notifying law enforcement and regulatory bodies. Yet, amidst ongoing investigations, inquiries regarding the breach and the group’s affiliation with Bian Lian remain unanswered.
Related Incidents in the Sector
It is worth noting that TADTS is not alone; other firms in the drug and alcohol testing sector have also experienced significant breaches of sensitive data in recent months. In February, DISA Global Solutions, another Texas-based administrator of drug testing services, disclosed a data theft incident affecting approximately 3.3 million individuals.
DISA reported unauthorized access to its systems during a period from February 9, 2024, to April 22, 2024. Their investigations indicate that sensitive personal and financial information was compromised, similar to the TADTS case.
As these incidents unfold, they highlight ongoing vulnerabilities within organizations handling sensitive information. The MITRE ATT&CK framework provides valuable insight into potential adversary tactics and techniques, including initial access and privilege escalation, which may apply to both TADTS and DISA’s breaches.
