Air Comfort listed on Rancoz ransomware leak site

• Ransomware group: Rancoz
• Sector: Hospitality
• Announcement date: June 14, 2023

Rancoz claims data breach against Air Comfort

The threat actor known as Rancoz has listed the organization Air Comfort on its dedicated leak platform. According to the announcement made on June 14, 2023, the group claims to have successfully targeted the entity, marking a new entry on their public leak site. This type of activity is characteristic of modern ransomware operations, where attackers often employ double extortion tactics. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations but also focus on exfiltrating sensitive data to increase their leverage during negotiations.

The announcement, which was created on June 14, 2023, serves as a public notification of the alleged breach. By publishing the name of the victim on a leak site, ransomware groups aim to pressure the targeted organization into meeting their demands. While the group has listed the organization, the specific motivations and the exact operational methods used by Rancoz remain unclear due to the limited public information available regarding this specific threat actor.

Details of the claimed data theft

The Rancoz group is currently offering a data archive, which they allege is associated with Air Comfort, for download. This archive is reported to have a total size of 140 MB. The presence of such an archive on a leak site indicates that the attackers claim to have gained unauthorized access to the organization's digital assets.

Regarding the specific contents of the leaked information, the situation remains somewhat ambiguous. The sample file shared on the leak site consists of an archive file measuring 140 MB, but there is no detailed information regarding the exact nature of the content contained within that file. The listing names no specific data types.

Implications and potential risks

This incident suggests that the digital assets of the organization may have been subjected to unauthorized access. When a data breach occurs, the consequences often extend beyond the immediate technical disruption. Depending on the actual content of the leaked data, several secondary risks may arise. These include the potential for identity theft or the execution of targeted phishing attacks directed at the employees or customers of the organization.

In the hospitality sector, where organizations handle various types of sensitive information, the impact of such breaches can be significant. For organizations facing similar threats, common defensive measures include implementing robust multi-factor authentication, maintaining regular offline backups, and conducting thorough employee training to recognize social engineering attempts. Furthermore, organizations are often advised to review relevant legal regulations regarding data breach notification obligations to ensure they inform the affected parties and regulatory bodies in a timely manner according to the law.

Summary of the incident

• Organization: Air Comfort
• Threat Actor: Rancoz
• Claimed Data Size: 140 MB
• Announcement Date: June 14, 2023