ALPHV ransomware group lists SMS-SME refused to protect customer and business data on its leak site

• Ransomware group: ALPHV
• Country: United States
• Sector: Manufacturing
• Announcement date: August 25, 2023

ALPHV claims data breach at SMS-SME

The ALPHV ransomware group has published data they claim belongs to SMS-SME on their leak site. According to an announcement made on August 25, 2023, the group has targeted the organization, alleging that they successfully exploited vulnerabilities within the company's network. The threat actors have used this incident to claim that the firm failed to protect sensitive customer and business data, subsequently issuing a statement that threatens to expose the company's information.

In many modern ransomware attacks, groups employ a tactic known as double extortion. This method involves not only encrypting the victim's files to disrupt operations but also exfiltrating sensitive data before the encryption occurs. The threat actors then use the stolen information as leverage, threatening to leak it on public or semi-public leak sites if their demands are not met. This approach increases the pressure on organizations, as the threat of public exposure can lead to significant reputational damage and legal consequences.

The specific details regarding the size of the data stolen, the total number of files involved, and the specific ransom demand have not been provided in the leak site announcement.

Sensitive information allegedly exposed

The screenshots provided by the attackers appear to display a variety of sensitive corporate and personal information. The data identified in the leak includes several categories of highly sensitive documentation that could impact both the company and its stakeholders. The following items have been identified as part of the alleged data exposure:

• Passport data
• Employee non-disclosure agreements
• Invoice information
• Bank transfer documents
• Patent records

The exposure of such diverse data types—ranging from personal identification to proprietary intellectual property—presents a multifaceted security challenge for the targeted organization.

About SMS-SME

SMS-SME is an engineering firm founded in 1993 that provides technology, design, and equipment solutions for the shipbuilding industry. The company is known for its innovative product lines and engineering services tailored for global shipyards and the maritime sector.

Impact and industry implications

The alleged data leak may increase the risk of identity theft for employees and business partners. Given that the company is based in the United States, the incident may be subject to state-level data protection laws and potential legal scrutiny. Considering the past activities of the ALPHV (BlackCat) group, it is possible that this data could be utilized for secondary attacks or targeted phishing campaigns. Furthermore, the exposure of trade secrets, such as patent and contract documents, may harm the company's competitive standing and damage trust with business partners.

For organizations operating within the manufacturing and engineering sectors, such incidents highlight the critical importance of robust cybersecurity frameworks. Protecting intellectual property, such as patents and design specifications, is vital for maintaining a competitive advantage. Additionally, securing personal employee data and financial documents is essential for regulatory compliance and maintaining the trust of the workforce and global partners. Organizations often implement defensive measures such as multi-factor authentication, regular network vulnerability assessments, and strict access controls to mitigate these risks. However, as seen in this instance, the potential for secondary exploitation of leaked data remains a significant concern for the cybersecurity landscape.