ALPHV ransomware group lists KKDICOID including companies AICC, JBI, TJFI (part of the kddicom holding company, whose d on its leak site

• Ransomware group: ALPHV
• Country: Japan
• Sector: Technology
• Announcement date: July 26, 2023

ALPHV claims data theft from KDDI Corporation and subsidiaries

The ALPHV ransomware group has announced that it has obtained data belonging to companies operating under the KDDI holding company. According to the threat actor, the breach involves several entities within the group, specifically identifying AICC, JBI, and TJFI as targets of the operation. The announcement regarding this data leak was made on July 26, 2023, though the group claims the initial access occurred much earlier, on May 5, 2023.

Ransomware groups often utilize leak sites to host stolen information as a method of double extortion. In such scenarios, attackers do not only encrypt an organization's internal systems to demand a ransom for decryption but also threaten to publish sensitive data to pressure the victim into paying. By hosting stolen files on a public-facing leak site, the group aims to maximize the visibility of the breach and increase the psychological and reputational pressure on the targeted institution.

Details of the alleged intrusion

The ALPHV group alleges that it successfully gained access to the networks of the identified subsidiaries. The threat actor claims that the intrusion was made possible by exploiting vulnerabilities within the organization's network infrastructure. By leveraging these weaknesses, the group asserts it was able to exfiltrate a significant amount of sensitive information from the KDDI holding companies.

The group is currently using the publication of this allegedly stolen data on its dedicated leak site as a tool to exert pressure on the institution. While the group has made these claims, the specific methods used to exploit the network vulnerabilities have not been detailed in the public announcement.

Scope of the allegedly stolen data

The leak announcement provides a detailed list of the types of information that the group claims to have exfiltrated. The information reportedly includes a wide variety of sensitive records ranging from personal identifiers to highly technical corporate assets. According to the group, the stolen data includes:

• Employee personal data
• Partner data
• Financial records
• Passport data
• Fingerprint data
• Engineering blueprints
• Logistics data

In addition to the list provided by the group, the leak site reportedly features screenshots that serve as evidence of the theft. These screenshots allegedly display numerous identity documents and various samples of corporate spreadsheets, suggesting a broad scope of the data exfiltration.

About KDDI Corporation

KDDI Corporation is a leading telecommunications operator based in Japan. It is a multinational technology company providing mobile and fixed-line services, data center solutions, and corporate network services.

Risk assessment and implications

The nature of the data allegedly leaked by ALPHV carries significant risks for the affected parties. The exposure of personal information, such as passport data and fingerprints, significantly increases the risk of identity theft for both employees and business partners. Furthermore, the alleged theft of corporate technical documentation and engineering blueprints could result in the loss of vital trade secrets, potentially leading to a reduction in the organization's competitive advantage.

Beyond the immediate data risks, the organization may face legal challenges and processes under data protection regulations in Japan. Given the historical methods employed by the ALPHV group, there is a possibility that the stolen information could be utilized in secondary attacks or targeted phishing campaigns against the organization or its partners. Publicly available information regarding the specific operations and technical capabilities of the ALPHV group remains limited.

In general, organizations in the technology and telecommunications sectors can mitigate such risks by implementing robust network security measures, such as multi-factor authentication, regular vulnerability assessments, and strict access controls. Maintaining comprehensive logging and monitoring can also help in the early detection of unauthorized network access.