APT73 ransomware group lists rylandpeters.com on its leak site

• Ransomware group: APT73
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: August 22, 2024

APT73 claims data breach against Ryland Peters & Small

The threat actor known as APT73 has published a leak announcement on its dedicated leak site, claiming responsibility for a cyberattack targeting rylandpeters.com. According to the announcement made on August 22, 2024, the group asserts that they have successfully compromised the organization's network and obtained sensitive information.

The group has claimed that the volume of data exfiltrated from the network amounts to 447 MB. While the group has posted this information on their leak site, the breach remains an allegation made by the threat actor. Furthermore, the group has reportedly established a deadline for the publication of the mentioned data, a common tactic used to pressure victims during extortion attempts.

Details of the alleged data theft

The information provided by the threat actor includes several samples intended to prove the validity of the breach. These samples suggest that the attackers have gained access to internal organizational details. The data types identified in the provided screenshots include:

• Email addresses
• File server directory listings
• Network infrastructure diagrams

The presence of technical diagrams regarding the corporate network infrastructure is particularly significant, as such information can provide a roadmap for future unauthorized access or further exploitation of the network environment.

About Ryland Peters & Small

Ryland Peters & Small and CICO Books is an independent British publisher specializing in illustrated books on interior design, food, gardening, and lifestyle. Based in London, the company is known for producing beautifully crafted and visually oriented books.

Risk assessment and implications

The exposure of the allegedly leaked data carries several significant risks for the organization. The inclusion of email addresses and directory listings could potentially be used to facilitate highly targeted phishing attacks against the organization's employees and business partners. Such attacks often leverage stolen internal context to increase the success rate of social engineering attempts.

Furthermore, the exposure of technical details regarding the corporate network infrastructure may create vulnerabilities that could be exploited for secondary attacks. Because the organization is based in the United Kingdom, a confirmed breach of this nature may lead to significant data protection obligations and administrative sanctions under the UK GDPR framework. The legal and regulatory consequences of a data leak involving personal information can be extensive for companies operating within this jurisdiction.

Regarding the threat actor, information available in the public domain concerning the APT73 group remains limited. However, their observed ransomware tactics appear to involve double extortion strategies. Double extortion is a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten the public release of that data, thereby increasing the pressure on the victim to pay the ransom.

In general, organizations facing such threats often focus on robust defensive measures. These include maintaining strict access controls, implementing multi-factor authentication, and conducting regular security awareness training to defend against phishing. Additionally, maintaining offline, immutable backups and ensuring network segmentation can help mitigate the impact of both data theft and encryption-based attacks. Monitoring for unauthorized data exfiltration and maintaining a comprehensive incident response plan are also critical components of a modern cybersecurity posture.