ALPHV claims data breach at Banco Comercial do Huambo

• Ransomware group: ALPHV
• Country: Angola
• Sector: Financial Services
• Announcement date: July 26, 2023

ALPHV claims to have leaked Banco Comercial do Huambo data

The ALPHV ransomware group has announced a significant data breach involving Banco Comercial do Huambo, a financial services institution based in Angola. According to the group's announcement on their leak site, they claim to have successfully targeted the institution's systems and obtained a vast amount of sensitive information. The group has already begun publishing portions of the alleged data to highlight the security vulnerabilities present within the organization's infrastructure.

The claim suggests that the cyberattack occurred around April 21, 2023, although the breach was officially announced on the group's leak site on July 26, 2023. In their public communication, the attackers have issued direct warnings to the customers of Banco Comercial do Huambo, advising them to withdraw their assets from the institution.

Details of the alleged data leak

The information released by the ALPHV group includes various types of sensitive documentation. Based on screenshots provided by the threat actors, the leaked content reportedly contains identity documents, bank statements, credit information, customer account details, and official government documents. Furthermore, the group claims that the breach encompasses critical financial and communication data, including SWIFT data, general financial information, and insurance-related data.

The specific types of data identified in the claim include:

• Customer identity information
• Bank account information
• Credit card information
• Financial transactions
• Insurance data

About Banco Comercial do Huambo

Banco Comercial do Huambo is a financial services institution located in Angola. The organization operates within the banking sector, providing various financial services to its client base.

Impact and security implications

The nature of the data allegedly stolen poses a significant risk to the affected individuals. The leak of identity documents, bank statements, and credit information significantly increases the potential for identity theft and various forms of financial fraud targeting the institution's customers. Beyond the immediate risk to individuals, the breach may have lasting negative impacts on the operational credibility of the institution.

From a regulatory perspective, the institution may face legal proceedings under the data protection regulations established in Angola. The breach highlights the severe consequences that such attacks can have on corporate reputation and the long-term security costs associated with remediating vulnerabilities and managing the aftermath of a breach.

The ALPHV group is recognized in the threat intelligence community for utilizing Rust-based malware and employing double-extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release unless a ransom is paid. This tactic places immense pressure on organizations by combining operational downtime with the threat of massive regulatory fines and reputational damage.

For organizations operating within the financial services sector, such incidents underscore the necessity of robust defensive measures. Common defensive strategies often include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees. Furthermore, organizations typically rely on continuous monitoring and incident response plans to mitigate the impact of such sophisticated threats.