Summary
Written by ThreatClusterfrom victim profile, leak postThe group claims they gained access to Momentum's diagnostic and provisioning tool via a compromised MSO, exposing PII for over 7.5 million users. They also state that the tool controls internet and voice services for millions of users across global markets, with Gomomentum.com identified as the victim. The leak post is published.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Domains
- gomomentum.com
What was taken
Momentum is a telecommunications company founded in 2001 that provides cloud-based communication solutions for businesses, specializing in cloud voice services, managed networks, SD-WAN solutions, and Microsoft Teams Phone integration. We gained access to a diagnostic and provisioning tool used by Momentum through a compromised Multi-Service Operator (MSO). Upon reconnaissance, we identified multiple critical vulnerabilities throughout the system. This tool controls internet and voice services for millions of users across global markets. We successfully accessed user data for every MSO, exposing personally identifiable information (PII) for over 7.5 million users.
Ransom note
Published by the group on their leak site, reproduced verbatim.
WARNING This is what happens when you ignore us or go ghost. Momentum Telecom is a prime example of negligence in action. They don't care about their 7.5 million customers whose PII has been exposed. They don't care about the 100,000+ people who lost internet service due to widespread outages we caused as a direct result of their poor security practices. The Eagle Mountain, Utah "cyberattack" and internet outage that made national news? That was us. That was a direct consequence of Momentum's failure to secure their systems. They ignored repeated warnings, they burned access repeatedly, and we kept gaining it back. We deleted modems, caused service disruptions, and left families, businesses, and students without internet for days. Read the coverage: ABC4 (https://www.abc4.com/news/wasatch-front/eagle-mountain-internet-outage-cyberattack/) | Fox 13 (https://www.fox13now.com/videos/news/local-news/utah-county/eagle-mountain-residents-impacted-by-days-long-internet-outage) Momentum management repeatedly contacted us, then ghosted us every single time. They reached out to initiate negotiations, then disappeared. They agreed to terms, then stopped responding. They don't take this seriously. They don't care about their customers. Now their data is public and their customers are paying the price for their arrogance. Don't be like Momentum. Don't ignore us. Don't go ghost. When we reach out, we expect a response. When we say we have your data, we have your data. When we say we can cause damage, we can cause damage. Contact us. Negotiate. Resolve this before you become the next headline.
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- download DB
- https://limewire.com/d/6UHfn#DNt3TAEaXR
Leak-site images (11)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.