Malicious hackers say they demanded $50,000 ransom for stolen Bell data

A pair of malicious hackers say they demanded that Bell pay a $50,000 US ransom to prevent stolen customer data from being shared online, according to a person claiming responsibility for the theft.

That person who communicated with CBC News via encrypted chat using the handle "exodus" says a ransom email was sent to Bell on May 5, detailing the extent of the breach and the thieves' terms.

Bellapologized to its customerslastweekafter 1.9 millionemailaddresses and approximately 1,700 names and phone numbers were stolen from the company's systems and posted online. Links to the data were thenshared across social media.

"We were literally inside Bell's networks with access to everything," exodus told CBC News. "It could have been much worse for them."

Even after the breach was revealed, exodus claimed to still have access to Bell servers, and to have stolen additional data that could still be leaked in particular, "all passwords for Bell customers." They were unable to offer any supporting proof.

Bell previously told customers that "there is no indication that any financial, password or other sensitive personal information was accessed."

Bell's director of communications Marc Choma declined to comment on any of exodus's claims, which could not be independently verified byCBC News. He previously told Reuters that "a demand for payment was made by the hacker, but it was not paid."

The breach is the latest in a string of high-profile malicious hacks that have held large corporations' data for ransom.

In April, a person or group who went by the name "thedarkoverlord" leaked the latest season of the Netflix TV series Orange Is the New Black, more than a month before its premiere, after the streaming service declined to pay up.

And earlier this month, it was reported that Disney's upcoming film Pirates of the Caribbean: Dead Men Tell No Tales had also been stolen and held for an unspecified ransom, though it's unclear if the two attacks are related. The movie hasn't yet been leaked.

More recently, companies and individuals continue to grapple with the fallout from the WannaCry ransomware attack, which held hostage hundreds of thousands of computers around the globe, before malware researchers curtailed its rapid spread.

'They have many security vulnerabilities'

CBC News made initial contact with exodus through an account called "exodusbell"on the website Reddit.

The account was created last Monday the day the breach was made public and it madethree postsin the hours beforeBell issued a statement confirming the breach.

Each post was titled "Bell.ca Media leak. Be warned Bell," which sent visitors toa website with amessage from the thieves, before linking to yet anotherwebsite that hostedthe leaked files.

The timing of the posts which appearedto be the first to publicly link to the leaked material suggestthey were likelyshared by the malicious hackers themselves, or by someone on their behalf.

According to an email that exodus shared with CBC News, the pair demanded Bell send $50,000 US in bitcoin within 14 days of the email's receipt. In exchange, they claimed they would honour a signed contract promising "video and cryptographical evidence" of thedata being"securely deleted."

• How a perfect storm allowed a global ransomware attack
• Canadian hospitals may struggle to fend off cyberattacks

If Bell refused to co-operate, the pair would leak the stolen data online.

It "would be unfortunate if your customers had another reason to hate you," said theemail to Bell, which linked to the same website that was later shared online, directing visitors to files containing the leaked data.

Exodus says Bell never responded a fact Choma confirmed to Reuters last week.

It is not the first time that unauthorized users have breached Bell's systems and leaked customer information. In 2014, the RCMP charged a Quebec youth after a Bell contractor was breached and 22,421 user names and passwords, as well as five valid credit card numbers, were posted online.

"They really don't care about their customers," exodus said. "They have many security vulnerabilities."

Some hackers will report vulnerabilities they find to companies sometimes in exchange for payment, or for altruistic reasons but try to avoid doing things that might be deemed illegal, such as taking user data. The Bell breach does not appear to be one of those cases, as exodus says their actions were "highly financially motivated."

"Unlike the kids last time, we have owned them, and no [law enforcement]creeping about," exodus said.

The account stopped responding to messages from CBC News late last week.