Disney Ditches Slack After Major Data Breach

The Walt Disney Company is set to discontinue its use of Slack after a substantial data breach in July exposed over 1TB of confidential information from the company's internal communication channels. According to reports from CNBC, Disney has initiated the process of migrating to new, streamlined enterprise-wide collaboration tools and has informed employees that this transition will be completed by the end of the next fiscal quarter.

The decision to move away from Slack follows a significant incident involving a threat actor identified as 'NullBulge.' This hacker managed to breach Disney's Slack platform, stealing 1.1TB of sensitive data, which included messages and files from nearly 10,000 channels. The stolen information encompassed crucial details about upcoming projects, financial data, IT information, and other confidential material. 

This incident was not Disney's first brush with a data breach. Just a month earlier, the company faced another security lapse when 2.5GB of data, including information related to Club Penguin and corporate resources, was leaked on the 4chan message board. 

As Disney pivots away from Slack, questions arise about how employees will communicate in the future. It remains unclear whether the company will transition to another enterprise platform, such as Microsoft Teams, or develop its own internal software solution. 

The vulnerabilities of communication platforms like Slack make them attractive targets for cybercriminals. Hackers can exploit these channels to steal sensitive files, which can be used for extortion or to further taunt their victims. Notable incidents include the 2022 breach of Uber’s Slack server by the Lapsus$ group, which leveraged stolen employee credentials to mock the company’s staff. Additionally, in August 2023, Activision's Slack was breached, resulting in the theft of employee data and information regarding upcoming game releases.

As Disney navigates this transition, the focus will likely be on enhancing security measures to protect sensitive information and prevent future breaches, ensuring that employees can communicate effectively while safeguarding corporate data.