ALPHV ransomware group lists ELOTECH - HACKED AND MORE THEN 100 GB DATA LEAKED! on its leak site

• Ransomware group: ALPHV
• Country: Brazil
• Sector: Government & Defense
• Announcement date: July 26, 2023

ALPHV claims data theft from Elotech

The ALPHV ransomware group has listed the Brazilian technology company Elotech on its leak site. According to the announcement made on July 26, 2023, the threat actors claim to have exfiltrated a significant amount of data belonging to the organization. The group alleges that the attack took place on December 24, 2022.

The threat actors have issued a deadline, stating that if the organization does not establish contact within 48 hours, the stolen data will be published publicly. This tactic is a hallmark of modern ransomware operations, where pressure is applied to the victim through the threat of public exposure. The group has provided screenshots as evidence to support their claims, which allegedly show the company's internal files and directory structures.

Data and files involved in the claim

The ALPHV group claims to have stolen more than 100 GB of data from Elotech. The provided screenshots reportedly display various documents, files, and directory structures that the group asserts are the company's source codes. No specific information was provided regarding the exact file count or the specific amount of a ransom demand.

The data types allegedly involved in this breach include:

• Source code
• Corporate data

About Elotech

Elotech is a technology company based in the state of Paraná, Brazil. The organization specializes in providing software solutions for public administration institutions. Their primary focus is the development of management systems designed specifically for municipalities and various public agencies.

Analysis and potential risks

The claims made by the ALPHV group pose significant risks, particularly regarding the privacy of citizen data, given Elotech's role within the public administration sector. Under the regulations of Brazil's LGPD, the disclosure of personal data could lead to administrative and legal sanctions for the organization. The potential exposure of source code is also a critical concern, as it may create vulnerabilities that could be exploited in future attacks against the company's software infrastructure, thereby increasing supply chain risks.

The methods employed by the ALPHV group are known to follow a double extortion model. This strategy involves both the encryption of an organization's data and the exfiltration of that data to use as leverage. Because of this approach, organizations targeted by such groups may face secondary waves of attacks, such as targeted phishing campaigns directed at the organization's customers and business partners.

In such scenarios, organizations typically focus on defensive measures such as robust data encryption, regular offline backups, and strict access controls to mitigate the impact of exfiltration. Monitoring for unusual data movement and implementing multi-factor authentication are also standard industry practices to defend against the initial intrusion and subsequent data theft.