ALPHV ransomware group claims data breach against HAL Allergy

• Ransomware group: ALPHV
• Country: Spain
• Sector: Healthcare
• Announcement date: November 2, 2023

The ALPHV (BlackCat) ransomware group has claimed to have published data belonging to HAL Allergy on its dedicated leak site. According to the announcement made by the threat actor group, the organization's information has been compromised in a recent cyberattack.

The details of the claim

The ALPHV group listed HAL Allergy on its leak site on November 2, 2023. Through this announcement, the group alleges that it has successfully obtained certain files belonging to the organization. The publication of this claim included specific references to the company's extensive operations across Europe, suggesting the potential scope of the impact of the alleged breach.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a method known as double extortion. In these scenarios, attackers not only encrypt an organization's internal systems but also steal sensitive data, threatening to release it publicly if the ransom is not met. This tactic aims to maximize leverage by threatening the victim's reputation and regulatory standing.

Data involved in the alleged leak

The announcement made by the ALPHV group specifies the existence of a data package. This package is reportedly titled "Invoices + EU Plans" and has a reported size of 62.4 MB. The contents of the leaked data, as described by the threat actor, include the following items:

• Invoices
• EU operational plans

While the specific file count and the exact ransom demand were not provided in the announcement, the presence of financial and strategic documentation represents a significant concern for the targeted entity.

About HAL Allergy

HAL Allergy is a leading Europe-based biotechnology company specializing in allergen diagnostics and immunotherapies. The company develops therapeutic and diagnostic products for common allergies such as hay fever, house dust mites, and insect stings.

Risk assessment and implications

The claim of a data leak may bring about the risk of exposure for the operational and financial data of an organization operating in the healthcare sector. Given the company's extensive operations across Europe, it is assessed that the leaked data could lead to personal or commercial privacy violations under the General Data Protection Regulation (GDPR). The inclusion of invoices and planning documents in the leaked data may create secondary risks for the company's business partners and supply chain.

Considering the known methods of the ALPHV group, it can be anticipated that such data could be utilized for identity theft or targeted phishing attacks. In such attacks, criminals use stolen information to craft highly convincing messages to deceive employees or partners.

For organizations operating in sensitive sectors like biotechnology and healthcare, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security awareness training for staff to recognize phishing attempts. Furthermore, strict access controls and continuous monitoring of network traffic can help detect and mitigate unauthorized data exfiltration attempts before they result in a public leak.