Banco Promerica listed on Snatch ransomware leak site

• Ransomware group: Snatch
• Country: Costa Rica
• Sector: Financial Services
• Announcement date: January 13, 2024

The Snatch ransomware group has listed Banco Promerica on its dedicated leak site. According to an announcement made by the threat actor group, the Costa Rican financial services institution has been targeted in a cyberattack that allegedly resulted in a data breach.

The alleged attack and claim

The Snatch group announced an alleged data leak concerning Banco Promerica on January 11, 2024. This claim was published via the group's own leak platform, which serves as a public notification system for their victims. By posting the organization's name on their site, the group is utilizing a common tactic used by modern ransomware operators to pressure victims into meeting specific demands.

Ransomware leak sites are a central component of the double extortion model. In this scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information. The threat of leaking this stolen data on a public platform is used as leverage to coerce the victim into paying a ransom. If the victim refuses to comply, the group threatens to release the data, which can lead to significant reputational damage and regulatory scrutiny.

Details regarding the leaked data

At this time, there is no information regarding the nature of the leaked data, and no screenshot has been provided by the attackers to substantiate their claims. The listing does not specify the volume of data stolen or the specific types of files involved in the breach.

• No specific data types were named in the listing.

Because the group has not provided visual evidence or a detailed inventory of the stolen files, a definitive assessment of the scope of the attack and the sensitivity of the data cannot be made at this stage.

About Banco Promerica

Banco Promerica is a multinational financial services group affiliated with the holding company Promerica Financial Corp (PFC). The organization operates across Central America and the Caribbean, providing a wide range of banking and financial solutions to its diverse client base.

Risk assessment and industry implications

This incident may pose secondary risks such as identity theft or targeted phishing attacks for the institution's customers and employees. When sensitive information is exfiltrated, attackers often use it to craft highly convincing social engineering campaigns, making it difficult for individuals to distinguish between legitimate communications and fraudulent ones.

Furthermore, the Snatch group is known for specific technical methodologies, such as encrypting systems by rebooting them in safe mode. Given this known behavior, it is possible that the institution's operational continuity has also been affected by the attack. Disruptions to operational continuity can impact the ability of a financial institution to provide services to its clients, potentially leading to broader economic or service-level consequences.

From a regulatory perspective, this situation could lead to legal and administrative sanctions within the framework of Costa Rican regulations and general data protection standards. Financial institutions are subject to strict oversight regarding how they protect consumer data and maintain system integrity.

In response to such threats, organizations in the financial sector typically focus on several defensive pillars. These include implementing robust multi-factor authentication (MFA) across all access points, maintaining rigorous patch management schedules to close vulnerabilities, and ensuring that offline, immutable backups are available to facilitate recovery. Additionally, continuous monitoring of network traffic can help detect the lateral movement and data exfiltration phases of a ransomware attack before the final encryption occurs. As public information regarding the specific activities of the Snatch group remains limited, organizations must remain vigilant against the evolving tactics used by such threat actors.