ALPHV claims to have leaked data from threesixtysourcingcom

• Ransomware group: ALPHV
• Country: Hong Kong SAR China
• Sector: Professional Services
• Announcement date: July 26, 2023

ALPHV claims to have leaked data from threesixtysourcingcom

The ALPHV ransomware group has published data on its leak site that it claims belongs to threesixtysourcing.com. This announcement, made on July 26, 2023, involves a data breach claim that refers back to a cyber incident which the group alleges occurred in February 2022.

Details of the alleged cyber incident

The ALPHV (also known as BlackCat) group has listed data on its leak site that is stated to belong to threesixtysourcing.com. According to the group's announcement, the data can be downloaded via links provided by the attackers. While the announcement was made in mid-2023, the group claims that the actual attack or incident took place on February 17, 2022.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive information to pressure the victim into paying a ransom. By threatening to release stolen data publicly, the attackers aim to cause maximum reputational and operational damage. The use of a leak site allows the threat actor to demonstrate proof of the breach to the victim and the public, increasing the pressure to comply with ransom demands.

Data allegedly involved in the breach

The information allegedly stolen and shared by the group includes sensitive corporate financial documents. Based on screenshots provided by the attackers, the leaked content is said to include various internal records. The specific types of data identified in the listing include:

• Financial data
• Budget reports
• Bank account information
• Customer information

Specifically, the content is reported to contain corporate financial documents such as 2020 budget plans, 2022 Asia budget balance sheets, HSBC bank account transactions, accounts receivable aging reports, and customer lists. No information was provided regarding the total size of the data or the specific file count involved in this incident.

The organization profile

ThreeSixty Sourcing is a company that provides global supply chain management, product development, and sourcing services for retailers and brands. The company specializes in managing manufacturing processes, particularly in the Asian market, and offers end-to-end logistics and quality control solutions to its clients.

Analysis and potential implications

The alleged leaked data may contain sensitive information regarding the organization's financial strategies and customer relationships. This situation could create negative impacts on the organization's commercial operations and may provide a strategic advantage to competitors. The exposure of such data to third parties could pave the way for targeted phishing attacks against the organization's supply chain partners.

Given the past activities of the ALPHV group, it is possible that the leaked data could be used for identity theft or corporate espionage. Furthermore, depending on the region where the organization operates, it may face administrative sanctions under data protection regulations due to the exposure of sensitive information.

For organizations operating in the professional services and supply chain sectors, protecting sensitive financial and customer data is critical. Defensive measures typically include implementing robust access controls, maintaining strict data encryption standards, and conducting regular audits of financial systems. Organizations should also focus on employee training to recognize phishing attempts, as leaked customer and partner information is frequently used to facilitate secondary attacks against the broader supply chain.