Atol.ru listed on Werewolves ransomware leak site

• Ransomware group: Werewolves
• Country: Russia
• Sector: Technology
• Announcement date: December 20, 2023

Russian technology company Atol.ru targeted by Werewolves ransomware group

The Russian technology company Atol.ru has been listed on the leak site of the ransomware group known as Werewolves. According to the announcement made on the group's platform on December 20, 2023, the threat actors claim to have successfully targeted the organization, alleging a significant breach of their internal systems. The group claims the attack occurred on October 4, 2023.

Details of the alleged breach

The Werewolves group claims to have compromised database servers belonging to Atol.ru. Through this unauthorized access, the threat actors allege that they have obtained sensitive information, including customer data, software source code, and personal information. The group is utilizing a double extortion tactic, a common method in modern ransomware attacks where criminals not only encrypt data to disrupt operations but also threaten to publish stolen information on public leak sites to increase pressure on the victim.

In this specific instance, the group is demanding a ransom of 450,000 USD. This payment is being sought in exchange for the group's promise to delete the compromised information and refrain from publishing it on their general leak platform. A screenshot provided by the group displays the interface of their leak platform, which serves as a public notice to pressure the organization into compliance.

Data types involved in the claim

While the exact volume of the data exfiltrated has not been specified, the group has identified several categories of sensitive information that they claim to have obtained during the breach. The following data types are allegedly included in the stolen datasets:

• Customer data
• Software source code
• Personal data

About Atol.ru

Atol is a leading Russian technology company that manufactures hardware and develops software for the retail, e-commerce, and service sectors. The company specializes in several critical areas of digital infrastructure, including POS systems, warehouse automation, and cloud-based cash register services (KaaS). Due to the nature of these services, the organization plays a significant role in the technological operations of its clients.

Potential consequences and industry implications

This incident may create negative impacts on the organization's operational continuity and customer trust. The personal data allegedly exfiltrated could lead to secondary risks for the affected individuals, such as identity theft and targeted phishing attacks. Furthermore, given the cloud-based services provided by the organization, the leak could potentially have broad consequences across the supply chain, as many businesses rely on such technology for their daily operations.

It is likely that the organization will face legal processes within the framework of data protection regulations in Russia. For organizations operating in the technology and service sectors, such incidents highlight the importance of robust security measures. Common defensive steps for organizations facing these threats include implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits. Information regarding the specific capabilities and identity of the Werewolves group remains limited.