andrews.bg targeted by Ransomed ransomware group

• Ransomware group: Ransomed
• Country: Bulgaria
• Sector: Retail & E-Commerce
• Announcement date: September 26, 2023

Ransomed group claims data compromise at andrews.bg

A ransomware announcement has been published claiming that the data of andrews.bg has been compromised. The Ransomed group has listed andrews.bg on their leak site, claiming to have obtained the institution's data. This announcement marks a potential security incident for the Bulgarian retailer.

Details of the ransomware claim

According to the threat actor, the attack is recorded as having occurred on September 25, 2023. The announcement itself was created on September 26, 2023. The Ransomed group has stated that they will leak all information in their possession if a ransom of 15,000 USD is not paid.

This type of tactic is a hallmark of double extortion ransomware campaigns. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The attackers then use the threat of leaking this information on a public leak site to pressure the victim into paying a ransom. This method increases the pressure on the target, as the loss of data confidentiality can be just as damaging as the loss of system availability.

Data involved in the incident

Regarding the specific nature of the compromised data, there is no information provided regarding the nature of the compromised data. No screenshot is available to verify the contents of the breach, and the listing names no specific data types.

Organization profile

Andrews is a Bulgaria-based men's clothing and fashion retailer. The company specializes in suits and formal wear products.

Risk assessment and organizational implications

This incident may pose a risk to the institution's operational continuity. Failure to meet the ransom demand could lead to the public disclosure of data, which may damage the institution's commercial reputation. Such leaks could trigger investigations by data protection authorities under GDPR.

Furthermore, if the compromised data includes customer or employee information, it could be used for identity theft or targeted phishing attacks. Public information about this group is limited.

For organizations operating in the retail and e-commerce sectors, maintaining robust cybersecurity posture is essential. Common defensive steps for organizations include implementing multi-factor authentication (MFA) across all remote access points, maintaining regular and offline backups of critical data, and conducting regular employee training to recognize phishing attempts. Additionally, organizations should implement network segmentation to limit the lateral movement of attackers and maintain comprehensive logging and monitoring to detect unauthorized access or data exfiltration in a timely manner. Protecting customer information is particularly critical for retailers to maintain consumer trust and comply with international data protection regulations.