apt73 ransomware group lists www.legilog.fr on its leak site

• Ransomware group: apt73
• Country: France
• Sector: Professional Services
• Announcement date: October 29, 2024

The threat actor group apt73 claims a breach of Legilog

The French professional services firm Legilog has been listed on a leak site by the threat actor group identified as apt73. The announcement, made on October 29, 2024, suggests that the organization fell victim to a cyberattack around October 8, 2024. This type of listing is a common tactic used by ransomware groups, often as part of a double extortion strategy. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to pressure the victim into paying a ransom by threatening to publish the stolen data on public leak sites.

The listing serves as a public notification from the threat actor, claiming that they have successfully exfiltrated a significant amount of data from the target. While the presence of a company on a leak site does not constitute a confirmed breach, it indicates that the threat actor is attempting to damage the organization's reputation and operational integrity by showcasing stolen assets.

Details of the alleged data exposure

According to the claims made by apt73, the breach involves approximately 10 GB of data. The threat actor asserts that this stolen information includes critical components of the organization's digital infrastructure and client management tools. Specifically, the group claims to have obtained access to CRM systems, export files, backups, and various forms of personal information. To support these claims, the announcement included screenshots that appeared to display samples of the organization's software interface alongside tables containing various personal records.

The data allegedly involved in this incident includes:

• CRM system data
• Backup files
• Personal data

The inclusion of screenshots showing software interfaces and data tables is a common method used by threat actors to provide a sense of legitimacy to their claims. These samples often contain snippets of customer or member records, which can be used to demonstrate the sensitivity of the information they have acquired.

About Legilog

Legilog is a technology company based in France that specializes in the development of management software. The company provides a variety of solutions designed for diverse sectors, including cultural institutions, businesses, religious organizations, and bishoprics. Their expertise lies in developing CRM systems and comprehensive corporate management solutions intended to streamline operations for their clients.

Analysis and potential implications

Information regarding the threat actor group apt73 remains limited in the public domain, making it difficult to attribute the attack or understand the group's full capabilities. However, the alleged exposure of data from a company like Legilog carries significant implications. Because the organization serves a wide range of clients, including religious and cultural institutions, the leak may pose secondary risks to those clients and partners, such as identity theft or the risk of receiving targeted phishing attacks.

Furthermore, since Legilog operates within France, the alleged exposure of personal data may fall under the regulatory scope of the EU General Data Protection Regulation (GDPR), which could lead to significant regulatory consequences for the organization. The claim that backups and CRM systems were compromised also suggests potential risks to the organization's operational continuity, as these systems are vital for day-to-day business functions.

In general, organizations in the professional services sector can take several defensive steps to mitigate the risks associated with such threats. Implementing robust data encryption for both at-rest and in-transit data can help protect sensitive information even if a breach occurs. Additionally, maintaining offline, immutable backups is a critical defense against ransomware, ensuring that an organization can restore its systems without complying with ransom demands. Regular security awareness training for employees can also help prevent initial access through common vectors like phishing. Finally, adhering to strict access controls and monitoring network traffic for unusual activity can assist in the early detection of unauthorized data exfiltration.