Cyber Attack Hits the Venice Biennale: A Closer Look
What Happened
On July 17, the Venice Biennale found itself amidst a significant cyber incident when the INC Ransom ransomware group listed the festival as one of its victims on their darknet leak site. This alarming announcement came to light after the festival’s organizers reached out to The Hollywood Reporter to disclose that sensitive information had been compromised.
Details of the Attack
The breach reportedly occurred on July 7, as unknown individuals accessed the Biennale’s servers. They managed to extract a large volume of data, including personal details such as names, email addresses, phone numbers, and mailing addresses. Notably, attendees looking to reclaim VAT on their accreditation fees also had their tax codes exposed.
However, the notification sent to affected parties, including journalists from The Hollywood Reporter, seems to underestimate the full extent of the breach. According to an initial post from INC Ransom, the hackers allegedly stole around 800 gigabytes of data. Among this data was a collection of sample documents uploaded to the darknet, further raising concerns about the severity of the breach.
Implications of the Data Leak
In its leak post, INC Ransom boasted about the insights they had gained from the stolen data, including financial details regarding the Biennale’s sponsorship earnings. They claimed to only showcase a fraction of the massive amount of data they had claimed to acquire from the festival.
The leaked documents included crucial information, such as spreadsheets that detailed sponsor payments, financial statistics, and even scans of identifying documents belonging to notable attendees. One of the most significant revelations in this data was the presence of banking and tax details related to actor Willem Dafoe, alongside a scan of his passport.
Response from the Venice Biennale
The Biennale quickly took action following the attack, disconnecting their systems from external access immediately upon discovering the breach. They informed the Italian police and legal authorities of the incident, seeking assistance in managing the fallout.
A spokesperson for the event explained, "As soon as we had certainty of exfiltration of specific data, our systems were blocked, which delayed thorough analysis for several days.” This proactive approach helped the organization contain any further risk, although it did lead to some temporary service disruptions.
Current Status and Future Events
While there were initial strains on operations following the breach, the Venice Biennale confirmed that all services are now back online and functioning normally. Established in 1895, the Biennale is a prominent supporter of the arts, recognized particularly for its annual Venice International Film Festival, which is scheduled to take place from August 27 to September 6 this year. The festival regularly attracts high-profile figures from the cinema world.
Understanding INC Ransom
INC Ransom is a relatively new ransomware group, first identified in August 2023. According to reports, they have already targeted 408 victims, utilizing strategies like spear phishing to gain initial access to their targets. Their tactics also include a method known as double extortion, where they not only encrypt stolen data but also threaten to publish it if demands are not met.
To date, the group has not disclosed additional information related to the Venice Biennale since their initial leak, but the consequences of this cyber incident remain a pressing concern for the arts community and beyond.
Conclusion
The cyber attack on the Venice Biennale serves as a stark reminder of the vulnerabilities present in digital systems, especially in high-profile events. As the festival prepares for its upcoming events, heightened security measures will likely be a priority to safeguard against future breaches.
