A data extortion group called RansomHouse has claimed responsibility for stealing approximately 450 gigabytes of sensitive data from AMD. According to reporting by Bleeping Computer and Tom's Hardware, the semiconductor company later confirmed it had launched an investigation into the incident.
The breach highlights how weak passwords continue to enable even sophisticated attacks against large technology companies. RansomHouse specifically mentioned that AMD relied on easily guessable credentials to protect critical systems.
What RansomHouse Claims to Have
RansomHouse stated it obtained 450GB of data from AMD's network. The group has released samples including network files, system information, and what it claims are AMD passwords. According to Restore Privacy's analysis of the released data, the information appears authentic.
The group said AMD used passwords like "password," "P@ssw0rd," "amd!23," and "Welcome1" to protect internal systems. These credentials are on every list of commonly guessed passwords and should never appear in enterprise environments.
RansomHouse told Bleeping Computer that rather than deploying ransomware, the group focuses on stealing data and demanding payment not to sell or release it. This "double extortion" model has become increasingly popular among data theft groups.
Timeline of the AMD Breach
According to RansomHouse's statements, the initial network access occurred approximately a year before the January 5, 2022 date AMD lost access. The group claimed its "partners" had quietly operated inside AMD's network for an extended period before being detected.
AMD has not publicly detailed the timeline or confirmed the specific data accessed. The company stated it is investigating and working with law enforcement, but has not provided specifics about what was stolen or when the breach was discovered.
Why RansomHouse Didn't Contact AMD
Unlike most extortion groups, RansomHouse told Bleeping Computer it did not contact AMD directly. The group said it believes negotiating through corporate channels involves too much bureaucracy and delays.
"Our partners think it's a waste of time: it's better to sell the data rather than wait for AMD representatives to react," a RansomHouse representative explained. This suggests the group considers AMD's data more valuable sold to other parties than held for ransom.
The group is currently analyzing the stolen information to calculate its monetary value before selling portions to interested buyers.
Our Analysis
The AMD breach demonstrates that even major technology companies struggle with fundamentals. Weak passwords are not a sophisticated attack vector; they are a basic security failure that should not occur in any organization with mature security practices.
This incident fits a pattern seen with other high-profile breaches in 2022. The LAPSUS$ hacking group successfully infiltrated Nvidia, Microsoft, Facebook, and other major companies primarily through weak or leaked credentials. RansomHouse appears to be using similar tactics.
For Spamachine readers, this breach serves as a reminder that personal password hygiene matters even when large organizations are compromised. If you use the same passwords at work and home, a breach at any company where those credentials are used puts all your accounts at risk.
Why Data Theft Groups Prefer Selling Over Ransoming
Traditional ransomware encrypts files and demands payment for decryption keys. However, encryption operations are noisy and often trigger incident response procedures that limit the payoff. Data theft groups skip the encryption step entirely, quietly exfiltrating information and then demanding payment not to release it.
This approach is more reliable for attackers. Companies may have offline backups allowing recovery without paying ransoms, but no backup protects against stolen data being released or sold. The threat of data exposure creates stronger use than encryption alone.
What to Watch Next
AMD's investigation will likely reveal more details about how attackers gained initial access and what data was actually compromised. The 70,000 devices reportedly connected to AMD's internal network suggests significant lateral movement was possible once inside.
Organizations should audit their own password practices in light of this breach. Ensuring no easily guessed passwords exist in corporate systems, implementing multi-factor authentication, and monitoring for credential leaks can prevent similar attacks.
Key takeaways
- RansomHouse claims to have stolen 450GB from AMD, including credentials
- AMD reportedly used weak passwords like "password" and "Welcome1"
- The group is selling data rather than demanding ransom from AMD directly
- Organizations should audit their own password practices immediately
Frequently asked questions
What did RansomHouse steal from AMD?
RansomHouse claims to have obtained 450GB of data including network files, system information, and AMD passwords, though AMD has not confirmed specific details.
How did attackers get into AMD's network?
RansomHouse indicated access was gained through weak passwords, with AMD using easily guessable credentials like "password" and "Welcome1" on internal systems.
What is RansomHouse doing with the stolen data?
The group is analyzing the data to calculate its value and plans to sell portions rather than negotiating directly with AMD for a ransom payment.
How does this breach compare to other recent corporate intrusions?
Similar to LAPSUS$ attacks on Nvidia, Microsoft, and Facebook, this breach relied primarily on weak credentials rather than sophisticated technical exploits.
What should organizations do to prevent similar breaches?
Organizations should eliminate weak passwords, implement multi-factor authentication, monitor for credential leaks, and regularly audit security practices.