Avannubo listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Spain
• Sector: Technology
• Announcement date: June 21, 2023

Rhysida claims data breach against Avannubo

The technology services provider Avannubo has been listed on the leak site of the Rhysida ransomware group. According to the claims made by the threat actor, the organization has fallen victim to a cyberattack, resulting in a significant data leak. The announcement, which appeared on the group's platform, suggests that a substantial amount of information has been compromised and made available to the public.

Ransomware leak sites are specialized platforms used by cybercriminal groups to pressure victims into paying ransoms. These sites function as a public gallery of shame, where stolen data is hosted to increase the visibility of the breach. In many instances, these groups employ a tactic known as double extortion. In a double extortion scheme, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information. The threat of leaking this data publicly serves as additional leverage to compel the organization to meet ransom demands.

Details of the alleged data theft

The Rhysida ransomware group has provided specific details regarding the scale of the alleged breach. The group claims that the data stolen from Avannubo consists of approximately 198,760 files. The total volume of the information claimed to be taken is 165 GB. Furthermore, the group alleges that all of these files have been made available for public access, meaning the data is no longer confidential and can be downloaded by anyone visiting the leak site.

The specific nature of the leaked data has not been stated by the attackers. However, considering the professional profile of the target, the contents may include technical infrastructure details or customer data. It is important to note that at the time of the initial capture of the leak site, the site was reported to be inaccessible. No ransom demand has been specified in the current information regarding this incident.

About Avannubo

Avannubo is a Spain-based technology company that provides IP telephony, mobile communication, and internet access services. The company operates in the field of telecommunications infrastructure and digital services, making it a critical provider within the technology sector.

Impact and security implications

Given the double-extortion tactics frequently utilized by the Rhysida group, this incident may impact the organization's operational continuity and lead to the exposure of customer information. Because Avannubo provides essential technology services, the leaked data could potentially include sensitive customer details or network configuration specifics. Such a breach may trigger legal sanctions under data protection regulations in the jurisdictions where the organization operates.

The exposure of such data carries significant secondary risks. Information obtained through these breaches can be utilized for secondary attacks, identity theft, or targeted phishing campaigns against the organization or its clients. For companies operating in the telecommunications and digital services sectors, maintaining robust security postures is vital to prevent the exposure of sensitive network configurations and customer identities.

Organizations in this sector often focus on implementing defensive measures such as multi-factor authentication, regular security audits, and strict access controls to mitigate these risks. While public information regarding the Rhysida group remains limited, the potential for data misuse highlights the ongoing threat posed by ransomware groups targeting infrastructure and technology providers.