ALPHV ransomware group lists FajarPaper was hacked The most dangerous company to cooperate with in Indonesia may pose a on its leak site

• Ransomware group: ALPHV
• Country: Indonesia
• Sector: Manufacturing
• Announcement date: July 26, 2023

ALPHV claims breach of FajarPaper

The ALPHV ransomware group has listed the Indonesian packaging paper manufacturer FajarPaper on its leak site. According to the announcement made on July 26, 2023, the group claims to have gained unauthorized access to the company's networks. This listing follows a period of alleged infiltration that the group claims began on May 21, 2023.

In its communication, the ALPHV group issued a specific warning directed toward the partners and customers of FajarPaper. The threat actors suggested that entering into business cooperation with the firm may pose significant risks to those entities. The group alleges that the exfiltration of a large volume of confidential data was made possible due to vulnerabilities existing within the company's internal systems.

Alleged data exfiltration details

While the specific volume and file count of the stolen data were not disclosed in the announcement, the group claims that a wide variety of sensitive information was compromised during the attack. The alleged theft involves a range of documents that could impact both the company's operations and the privacy of individuals associated with the firm.

The types of data allegedly exfiltrated include:

• Financial documents
• Logistics documents
• Passport information
• Personal data
• Insurance information
• Non-disclosure agreements (NDAs)
• Commercial contracts

The exposure of such diverse datasets, ranging from sensitive personal identification like passports to high-level commercial contracts, represents a significant breach of confidentiality for the organization.

About FajarPaper

PT Fajar Surya Wisesa Tbk, operating as FajarPaper, is a leading packaging paper manufacturer headquartered in Indonesia. The company plays a significant role in the manufacturing sector by producing essential materials such as Kraft Liner Board, Corrugated Medium Paper, and Coated Duplex Board. These products are primarily used for the production of carton boxes and various types of display packaging.

Impact and security implications

This breach carries several potential secondary risks for the organization, its employees, and its customer base. The exposure of personal information, such as passport and insurance details, significantly increases the risk of identity theft and makes individuals targets for highly specific, targeted phishing attacks. Furthermore, the loss of trade secrets and commercial contracts could potentially damage the company's competitive advantage and lead to various legal liabilities.

The group responsible, ALPHV (also known as BlackCat), is a sophisticated threat actor known for utilizing complex ransomware developed in the Rust programming language. ALPHV typically employs double-extortion tactics, a method where attackers not only encrypt the victim's data but also steal it, threatening to leak the information on the internet if a ransom is not paid. This tactic places immense pressure on organizations because even if they can restore systems from backups, they still face the threat of public data exposure.

Given that FajarPaper operates within Indonesia, the company may face complex compliance processes and potential sanctions under local data protection regulations following such a breach. For organizations in the manufacturing sector, maintaining robust cybersecurity postures is critical to protecting intellectual property and maintaining trust with global partners. Common defensive strategies often include implementing multi-factor authentication, maintaining rigorous patch management to close system vulnerabilities, and conducting regular security audits to identify potential entry points for threat actors.