Hackers Breach Yellow Pages Canada and Steal Sensitive Documents

Canada’s Yellow Pages directory service had a run-in with hackers who reportedly made off with sensitive documents exposing personal information.

Black Basta ransomware operators last week named Yellow Pages Canada as their latest victim, sharing a sample of the pilfered personal information, as originally spotted by security researcher Dominic Alvieri.

The leak includes ID documents (scans of passports and driver licenses), tax documents exposing Social Insurance Number (SIN), sales and purchase agreements, an 'Accounts Receivable' spreadsheet dated Feb. 28, budget and debt forecast dated December 2022, and more, Bleeping Computer reports.

Yellow Pages Canada has yet to acknowledge the incident formally.

YP’s SVP and Chief Financial Officer Franco Sciannamblo agreed to respond to an inquiry from the cyber news site, saying:

“As soon as we became aware of the attack, we immediately commenced a thorough investigation into this issue with the assistance of external cyber security experts to contain the incident and ensure that we had secured our systems.”

“Based on our investigation to date, we have reason to believe that the unauthorized third party stole certain personal information from servers containing YP employee data and limited data relating to our business customers,” Sciannamblo said.

The CFO said YP Canada is now notifying affected individuals and privacy regulators.

The attack seems to have had little impact on YP Canada’s operations, with Sciannamblo adding “all of our services have now been restored."

The attack is said to have occurred sometime around March 15.

The Black Basta ransomware operation was behind a recent attack on Capita, a major outsourcer of professional services and consultancy. The hacking group was also behind a similar attack on US broadcaster Dish Network in February.

Bitdefender Digital Identity Protection scans the web for unauthorized leaks of your personal data, monitoring your accounts for potential exposure to fraud or social engineering, making it easy to take action before disaster strikes.