APT73 ransomware group lists www.bigalsfoodservice.co.uk on its leak site

• Ransomware group: APT73
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: June 13, 2024

APT73 claims to have compromised Big Als Foodservice

The threat actor known as APT73 has published a leak announcement on its dedicated leak site targeting the organization www.bigalsfoodservice.co.uk. According to the announcement, the group claims to have successfully obtained sensitive data belonging to the organization. This development follows a pattern common in modern cyberattacks where threat actors use public leak sites to pressure victims by threatening the release of stolen information.

The incident was officially announced on June 13, 2024, which coincides with the date the group claims the attack took place. The announcement on the leak site includes a countdown timer, a tactic often employed by ransomware groups to create a sense of urgency and pressure the victim into meeting specific demands before the data is released to the public.

Details of the alleged data theft

While the specific volume of the stolen data is reported to be 120 KB, the content of the breach appears to be highly sensitive regarding the organization's internal operations. The group claims to have obtained information related to the organization's network infrastructure and user access credentials. Screenshots provided by the threat actor suggest that the stolen information includes critical technical details that could be used to facilitate further unauthorized access.

The specific types of data identified in the claim include:

• Network configuration data
• User access credentials
• IP addresses

Based on the available information, the leaked content reportedly includes network device configuration details, SSID and password information, and lists containing various usernames and passwords. No information was provided regarding the total file count or the specific amount of a ransom demand.

Implications for the organization and security risks

The allegedly leaked data contains critical information that could directly compromise the organization's network security. The exposure of network device configurations, IP addresses, and user credentials provides a roadmap for malicious actors. This type of information can lead to an increase in unauthorized access attempts and may facilitate secondary attacks against the organization by providing the necessary tools to bypass existing security perimeters.

Because the organization is based in the United Kingdom, this potential data breach may trigger legal obligations under the UK GDPR. Such regulations require organizations to manage and report data breaches that could impact the privacy and security of individuals. Given the nature of the information claimed to be stolen, the organization may face significant regulatory scrutiny and legal requirements regarding notification and mitigation.

General defensive considerations

In scenarios involving the theft of credentials and network configurations, organizations typically face heightened risks of lateral movement within their networks. When attackers possess valid usernames, passwords, and network maps, they can often move through a system with much greater ease and stealth. This underscores the importance of a defense-in-depth strategy, where multiple layers of security are placed throughout the network to detect and stop an intruder even if they have obtained valid credentials.

For organizations operating in the professional services sector or any other industry, several defensive steps are standard practice to mitigate the impact of such breaches. It is advised that organizations urgently update their network passwords and access configurations. Furthermore, enhancing security audits and implementing multi-factor authentication (MFA) can significantly reduce the utility of stolen credentials. Continuous monitoring of network traffic and regular vulnerability assessments are also essential components of a robust security posture to identify and remediate potential entry points before they can be exploited by groups like APT73.