AT&S listed on nokoyawa ransomware leak site

• Ransomware group: nokoyawa
• Country: Singapore
• Sector: Energy & Utilities
• Announcement date: July 29, 2023

The Singapore-based company AT&S has been listed on the leak site of the ransomware group known as nokoyawa. The threat actor has made a claim regarding a data breach involving the organization, signaling the start of a potential data exposure process.

The claims made by nokoyawa

The threat actor identified as nokoyawa has officially listed AT&S on its dedicated leak platform. In this announcement, the group alleges that a data breach has occurred within the organization's infrastructure. According to the information provided by the attackers, the group intends to publish the files they have allegedly acquired from the victim.

The announcement indicates that the group has already established a timeline for the release of the data. This development suggests that the process of data exposure has already commenced. While the group has asserted its possession of files, the specific details regarding the nature of the compromised data have not been provided by the attackers. The available information from the leak site's screenshot is limited to the descriptive text of the company itself.

Data involved in the alleged breach

At this stage of the incident, the specific details regarding the nature of the compromised data have not been provided. The listing does not specify the types of files or the volume of information that the group claims to have obtained. The current information available from the threat actor's platform consists only of the company's descriptive text without further technical details or file inventories.

About AT&S

AT&S is a company based in Singapore that operates within the energy and marine sectors. The firm provides a full spectrum of products and services tailored to the oil, gas, and marine industries. AT&S was formed through the merger of AquaTerra and SSH, and it currently offers comprehensive solutions to meet the needs of these specific industrial sectors.

Potential impacts and organizational risks

This incident may create negative impacts on the organization's operational continuity and commercial reputation. Because AT&S is a Singapore-based entity, the breach could potentially lead to legal obligations and administrative sanctions under the Singapore Personal Data Protection Act (PDPA).

The exposure of data poses significant secondary risks to the broader business ecosystem. The organization's supply chain partners and customers may become vulnerable to targeted phishing attacks if sensitive information is released. Furthermore, if the data is indeed released, the risk of double extortion may increase alongside the exposure of corporate secrets and customer information.

In the context of modern cyber threats, double extortion is a common tactic used by ransomware groups. In this scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This creates a dual pressure on the victim: the need to restore systems and the need to prevent the reputational and legal damage caused by a data leak.

When dealing with such threats, organizations in the energy and marine sectors often focus on strengthening their defensive posture. Common defensive steps include implementing robust access controls, maintaining regular offline backups, and conducting employee training to recognize phishing attempts. Given that public information regarding the nokoyawa group remains limited, organizations must remain vigilant against the evolving tactics used by such threat actors.