[Author’s Note: I am in no way, shape, or form affiliated with this investigation. Any discussion of time frames or investigative procedure is based purely on openly available information.]

Here’s what we know. On January 28, 2016, an online actor known as TheCthulhu posted what he claimed was the initial data set of a large amount of data from the national Fraternal Order of Police website.

According to Cthulhu, this is just the beginning. He claims to have a whopping 18 terabytes of data. To put this in perspective, that’s about 1,125 of those 16-gig thumb drives you have in your pocket. Yes, that is a ton of information.

Furthermore, this was followed up by an announcement from National FOP President Chuck Canterbury that the FOP website had been the victim of a data breach, and large amount of data was compromised. This also coincides with the statements from TheCthulhu.

Currently, the national FOP site is down.

Analysis

This is the real deal.

We’ve already seen plenty of cases of hacktivists claiming that they breached an organization, but those claims are quickly refuted (as we’ve previously discussed here at CalibrePress.com) when we discover the information posted is all easily available publicly.

However, the information posted does not appear to be publicly available and it’s followed up by the statement from the victim group’s president confirming a large breach.

If the government and DOD had their really bad year last year with the OPM breach, this is will probably be our equivalent.

Who is this Cuthulhu?

The actor known as Cthulhu has already made a few comments regarding this incident.

And he’s already well-known as a developer named Thomas White, who as recently as January 19 was in custody, according to his Twitter account.

Why isn’t he in jail yet? According to him, someone contacted him and provided the hacked information to him. In other words, he’s claiming he is a recipient not a perpetrator. Or something like that. He’s already well known for hosting other data dumps from other large hacks.

Next Steps

Obviously readers at this site are pretty familiar with the investigative process. And if FOP really did have 18TB worth of data to lose, the mere forensics to analyze everything might take some time. In fact, my guess would be that you shouldn’t expect to hear anything new for a few days yet.

This will probably be followed by the obligatory ID theft insurance that comes along with a data breach. Additionally, just notifying affected victims is going to be incredibly costly to FOP. As more and more companies are finding, cyber security insurance is becoming a necessity due to the “when” not “if” nature of data breaches. Cyber security and data breach insurance can be helpful with paying for things like mailing out envelopes to victims. One health organization in a lightly populated state reported spending $4 million on stamps/envelopes alone after their data breach.

Conclusion

Welcome to 2016. It’s still January and this is how we’re starting the year off. We need to rethink how we address issues like cyber security and protecting ourselves, and our information. This mindset of “it’s the IT guy’s problem” must end, and we need to start taking accountability for our data and its security in every organization–not just the big ones.