Acer, a Taiwanese computer manufacturer that was previously reported on in March 2021 for suffering a REvil cyberattack, recently disclosed two additional cyberattacks that occurred in one week during October 2021 and were conducted by the same threat actor, “Desorden”. Late last week, Acer confirmed that the “isolated attack” occurred that breached its “after-sales service systems” in India. At that time, “Desorden” claimed responsibility for the attack on a common hacking forum and explained in a posting that they exfiltrated over sixty (60) gigabytes (GB) of databases and files from the company’s network servers. The actor also provided possible evidence of the breach with a video “showcasing the stolen files and databases, the records of 10,000 customers, and stolen credentials for 3,000 Indian Acer distributors and retailers”. Early this week, Acer confirmed that a second cyberattack occurred that breached its servers in Taiwan. The company pulled the vulnerable server after it was notified by the threat group, but the group also emphasized that additional servers are vulnerable in Indonesia and Malaysia. “Desorden” contacted BleepingComputer to explain that employee and product information was exfiltrated during the attack as well as sharing “evidence” of the “internal Acer Taiwan portal and CSV files containing login credentials for Acer employees”. “Desorden” also revealed that the goal of conducting the second attack “was meant to prove our point that Acer has neglected their cyber security”. Acer confirmed the Taiwan data breach but stated that it does not involve customer data but employee data only. A ransom has not yet been disclosed by Acer, but CTAPT will provide additional information related to Acer and “Desorden” as it becomes available.