AF Supply listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: November 2, 2023

ALPHV claims data exfiltration from AF Supply

The ALPHV ransomware group has officially listed AF Supply on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully exfiltrated data from the organization. This development marks a significant escalation in the cyberattack targeting the New York-based company.

The listing was announced on November 2, 2023, coinciding with the date the group claims the attack took place. In the announcement, the ALPHV group initiated a ransom demand process, setting a strict ultimatum for the victim. The group stated that if the organization does not reach out to them within 48 hours, they will proceed to publish the entirety of the allegedly exfiltrated data on their public platform. To support their claims of unauthorized access to the organization's digital assets, the group provided visual evidence in the form of screenshots.

Alleged data types and contents

The visual evidence provided by the attackers includes screenshots of folder structures that suggest a wide variety of sensitive information has been compromised. The contents of these folders appear to include highly sensitive documentation that could pose significant risks if released publicly. The information identified in the screenshots includes:

• Court documents
• Financial records
• Insurance information
• Invoices and receipts
• Medical records
• Tax documents
• Personal data

The presence of such diverse file types suggests that the breach may have touched various departments within the organization, from human resources and finance to legal and medical administrative files.

About AF Supply

AF Supply is a retail company based in New York. The organization operates within the retail and e-commerce sector, specializing in the supply of plumbing, heating, and cooling equipment. Additionally, the company provides a range of kitchen and bathroom fixtures to its customer base.

Risk assessment and industry implications

The nature of the allegedly exfiltrated data, which includes both medical and financial records, presents a heightened risk for the organization's employees and customers. Such information is highly valuable to malicious actors and can be used to facilitate identity theft and various forms of fraud. Furthermore, because AF Supply operates in the retail and e-commerce sector, the potential exposure of customer data may lead to significant regulatory scrutiny under the General Data Protection Regulation (GDPR) or other relevant local data protection laws.

The ALPHV group, also known as BlackCat, is known for its use of Rust-based ransomware. Their operational history suggests a heavy reliance on double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt an organization's systems but also steal sensitive data, using the threat of a public leak to increase their leverage during ransom negotiations. This tactic is designed to maximize the pressure on an organization by threatening its commercial reputation and legal standing.

For organizations in the retail and supply chain sectors, such incidents can have a cascading effect. A breach of this nature may negatively impact the organization's commercial reputation and could potentially facilitate secondary phishing attacks directed at supply chain partners. To defend against such threats, organizations typically implement multi-layered security strategies, including robust backup solutions, strict access controls, and continuous monitoring of network traffic to detect unauthorized exfiltration attempts.