ARRCO LSM targeted by ralord ransomware group

• Ransomware group: ralord
• Country: Norway
• Sector: Retail & E-Commerce
• Announcement date: April 15, 2025

The ralord ransomware group claims a data breach at ARRCO LSM

The ransomware group known as ralord has posted an announcement on its leak site claiming responsibility for a data breach involving ARRCO LSM. According to the claim made on April 15, 2025, the threat actors have successfully exfiltrated a significant amount of information from the organization.

The threat actor asserts that they have gained control over the data belonging to ARRCO LSM and has stated that this information will be leaked. Furthermore, the group claims to have taken control of the company's accounts on various other platforms, expanding the scope of the alleged compromise beyond the organization's primary infrastructure.

Details of the alleged data exfiltration

The announcement specifies that the volume of the stolen data is approximately 5 GB. While the specific file count was not provided in the leak site post, the group has identified several categories of sensitive information that they claim to have acquired during the attack. The nature of the data suggests a broad compromise of the company's internal and financial records.

According to the screenshots provided by the attackers, the leaked data is claimed to include the following types of information:

• Payment information
• Secret documents
• Orders
• Backups
• Attachments
• Reports
• Plans
• Certificates

The presence of such diverse data types, ranging from financial records to technical backups and strategic plans, indicates a highly intrusive breach of the target's digital environment.

About ARRCO LSM

ARRCO (Lights Sound Magic) is a professional event technology company based in Hamar, Norway. The organization provides comprehensive technical solutions for events, which includes specialized services for sound, lighting, and visual systems. As a provider of technical infrastructure for events, the company plays a critical role in the technical execution of various professional gatherings.

Potential impact and industry implications

This alleged leak could have significant negative impacts on the operational processes of ARRCO LSM and the security of their customer data. The specific nature of the data claimed to be stolen, which encompasses trade secrets and financial information, poses a high risk to the company's competitive standing and internal operations. Furthermore, the types of data involved may create substantial risks for identity theft or the execution of targeted phishing attacks against the company or its clients.

Because ARRCO LSM is a Norway-based company, this incident may lead to compliance issues under the General Data Protection Regulation (GDPR) in the European Union. Such regulatory scrutiny often follows a data breach involving personal or sensitive information. Additionally, the situation could lead to long-term reputational damage and may expose the organization to secondary cyberattacks.

In the context of modern cyber threats, this incident reflects the mechanics of double extortion, a common tactic used by ransomware groups. In these scenarios, attackers not only encrypt a victim's systems to disrupt operations but also steal sensitive data to use as leverage during ransom negotiations. By threatening to leak the data on a public leak site, the group increases the pressure on the victim to comply with their demands.

For organizations operating in the retail and event technology sectors, such incidents highlight the necessity of robust defensive measures. Implementing strong access controls, multi-factor authentication, and continuous monitoring of account activity can help mitigate the risk of unauthorized access. Furthermore, maintaining offline, encrypted backups and adhering to strict data minimization principles are essential steps in reducing the potential impact of a successful exfiltration event. Organizations must also ensure they are prepared for the regulatory and reputational consequences that follow a breach of sensitive information.