ALPHV ransomware group lists VOPAK WAS HACKED A LOT OF CRITICAL CONFIDENTIAL INFORMATION WAS STOLEN on its leak site

• Ransomware group: ALPHV
• Country: Netherlands
• Sector: Energy & Utilities
• Announcement date: July 26, 2023

ALPHV claims a major data breach at Vopak

The ALPHV ransomware group has published a notice on its dedicated leak site, claiming to have successfully breached the network of Vopak. According to the announcement made on July 26, 2023, the threat actor group alleges that a significant volume of confidential information was stolen during the operation.

The group claims that the breach occurred on April 21, 2023. In their announcement, the attackers cite the exploitation of security vulnerabilities as the primary reason for their ability to penetrate the organization's network. The group's claims suggest that the breach was not a limited incident but rather a wide-reaching compromise of the company's digital environment.

Details of the alleged data theft

The information released by the ALPHV group suggests a broad compromise of corporate and technical documentation. The group alleges that the stolen data includes sensitive correspondence with both customers and business partners, as well as various technical infrastructure documents. Based on the samples provided by the group, the following types of data are reportedly involved:

• Employee personal data
• Customer data
• Business partner correspondence
• Engineering documents
• Supplier invoices

The presence of such diverse data types, ranging from personal employee information to technical engineering drawings and non-disclosure agreements (NDAs), indicates a deep level of access into the organization's internal files and business operations.

About Vopak

Vopak is a world-leading independent tank storage company for liquid bulk products. The company provides logistics services for the storage and handling of products such as oil, chemicals, gases, and biofuels.

Risks and industry implications

The nature of the data allegedly stolen by ALPHV presents several significant risks. The exposure of employee personal data and business partner correspondence creates a heightened risk of identity theft and targeted phishing attacks directed at the company's staff and its professional network. Furthermore, the theft of technical engineering drawings and corporate data could potentially impact the company's commercial operations and its competitive standing in the market.

Because Vopak is based in the Netherlands, this alleged breach may lead to legal and administrative sanctions under the EU General Data Protection Regulation (GDPR). The group's history of employing double-extortion tactics—where data is both encrypted and stolen to be used for blackmail—increases the secondary risks following the publication of such information on a leak site.

This incident highlights the ongoing necessity for organizations operating within the critical infrastructure sector to continuously review and strengthen their cybersecurity posture. Protecting against such sophisticated threats requires robust monitoring and a proactive approach to vulnerability management to prevent unauthorized access to sensitive technical and personal information.