Claims and risk services administration company Sedgwick Claims Management Services Inc. has confirmed that a cyberattack impacted one of its subsidiaries late last year after the TridentLocker ransomware group claimed to have stolen sensitive data from the company.

The cyberattack occurred on Dec. 30 and involved Sedgwick Government Solutions Inc., a subsidiary that provides technology-enabled claims and risk administration services to U.S. federal agencies.

Sedgwick ticked off the standard response list in an attack like this: isolating systems, employing third-party cybersecurity experts to help with the investigation and informing law enforcement and stakeholders.

The company said the initial investigations had determined the attack was limited to an isolated file transfer system used by the subsidiary. It added that there is no evidence that its broader corporate network or its claims management platforms were affected.

The targeted subsidiary, Sedgwick Government Solutions, notably works with multiple U.S. federal agencies, including the Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency. Sedgwick has begun notifying potentially impacted parties as part of its ongoing investigation, a process that could take weeks as forensic analysis continues.

The confirmation comes after the TridentLocker ransomware group claimed to have stolen about 3.4 gigabytes of data and threatened to publish the information if its demands were not met.

TridentLocker is a ransomware operation that uses a data extortion model that focuses on data theft and public disclosure threats rather than encrypting files.

“TridentLocker hitting a federal contractor serving DHS, ICE, CBP and CISA on New Year’s Eve is a statement,” Michael Bell, founder and chief executive of cybersecurity solutions provider Suzu Labs, told SiliconANGLE via email. “This group only emerged in November and they’re already going after companies that handle sensitive government claims and risk management data. Federal contractors remain high-value targets because attackers know these companies often have less mature security programs than the agencies they serve.”

He added that Sedgwick’s response about network segmentation “is what you want to hear, but 3.4 gigabytes from a file transfer system is still meaningful. These systems are designed to move documents between contractors and the agencies they serve and the investigation will determine what was actually in those files.”

Image: SiliconANGLE/Ideogram