Ausa listed on Trigona ransomware leak site

• Ransomware group: Trigona
• Country: Spain
• Sector: Manufacturing
• Announcement date: January 31, 2024

The Spanish manufacturing company Ausa has been listed on the leak site of the Trigona ransomware group. According to the announcement made on January 31, 2024, the threat actor claims to have gained unauthorized access to the organization's systems, leading to a potential data leak.

The Trigona ransomware claim

The Trigona ransomware group has published data they claim belongs to the company Ausa on their leak platform. This announcement follows an alleged attack date of January 11, 2024. In their communication, the group states that they are demanding a ransom of 350,000 USD from the organization to prevent the further release of information or to facilitate the return of data.

Information regarding the Trigona ransomware group remains limited in the public domain. Such groups typically operate using a double extortion model, where they not only encrypt an organization's internal systems to disrupt operations but also exfiltrate sensitive data to use as leverage. By threatening to publish stolen information on a public leak site, these actors aim to pressure the victim into paying the demanded ransom to avoid reputational damage or regulatory scrutiny.

Data involved in the alleged breach

While the exact volume of data and the total number of files involved have not been specified by the group, the screenshots provided on the leak site suggest that various types of sensitive documentation have been compromised. The leaked information appears to include critical business records that could be used for malicious purposes.

The content identified in the leaked materials includes:

• Commercial invoices
• Supplier information
• Product details
• Financial correspondence

The exposure of such documentation often provides attackers with a roadmap of an organization's internal business processes and its external relationships.

About Ausa

AUSA is a Spanish company founded in 1956, specializing in the design and manufacturing of compact all-terrain vehicles and construction machinery. With an extensive global dealer network, the company provides various equipment for the construction, agricultural, and industrial sectors.

Impact and organizational risks

The data allegedly leaked may contain sensitive information regarding the organization's supply chain partners and financial operations. This situation could increase the risk of targeted phishing attacks or Business Email Compromise (BEC) against the organization's partners. When attackers gain access to financial correspondence and supplier details, they can craft highly convincing fraudulent communications that mimic legitimate business transactions.

As the organization operates in Spain, the leak may result in legal and administrative consequences under the EU General Data Protection Regulation (GDPR). Organizations facing such incidents must navigate complex regulatory requirements regarding data breach notifications and the protection of individual privacy.

Furthermore, the public exposure of this data could damage the organization's commercial reputation and negatively impact its competitive advantage. In the manufacturing sector, where proprietary product details and supplier relationships are vital, such leaks can undermine market position. To defend against these threats, organizations typically implement layered security measures, such as multi-factor authentication, regular security awareness training for employees to recognize phishing attempts, and robust monitoring of network traffic to detect unauthorized exfiltration of data.