Banco Sol listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Angola
• Sector: Financial Services
• Announcement date: July 26, 2023

ALPHV claims breach of Banco Sol

The ALPHV (BlackCat) ransomware group has listed the Angolan financial institution Banco Sol on its dedicated leak site. According to the group's announcement, the breach is linked to an attack that allegedly occurred on February 13, 2023. The threat actors claim to have successfully infiltrated the institution's internal operations, gaining unauthorized access to various datasets belonging to the organization and its clientele.

The group alleges that the intrusion was not limited to simple data theft; they claim to have obtained sensitive technical information that could facilitate further malicious activity. Specifically, the threat actors assert that they have successfully exfiltrated the institution's network map and authentication credentials, which could provide a blueprint for navigating the internal environment.

Alleged data types involved in the leak

The information allegedly released by the ALPHV group encompasses a wide range of sensitive documents and personal identifiers. The scope of the claimed data suggests a significant compromise of both corporate and individual information. The following items are reported to be included in the leak:

• Employee personal data
• CVs
• Passport and ID information
• Financial reports
• Accounting data
• Loan and insurance agreements
• Customer credit card information
• Network access credentials

The inclusion of technical network maps and access credentials alongside personal and financial documentation indicates a highly targeted approach to the data exfiltration process.

About Banco Sol

Banco Sol is a private bank operating within Angola. The institution maintains a significant physical presence across the country, managing 180 branches. Through this extensive network, the bank serves approximately 940,000 clients, making it a major player in the local financial services sector.

Risk assessment and industry implications

This incident presents a high risk of identity theft and financial fraud for both the employees and the customers of Banco Sol. The exposure of highly sensitive financial data and internal network credentials poses a severe threat to the institution's operational security. Such information can be leveraged by threat actors to facilitate secondary attacks against the organization or its partners.

The ALPHV (BlackCat) group is recognized in the cyber threat landscape for utilizing tools developed in the Rust programming language. They are known for employing double extortion tactics, a method where attackers not only encrypt an organization's data to demand a ransom for decryption but also threaten to leak the stolen data on public forums to pressure the victim into paying.

For organizations operating in the financial services sector, such incidents underscore the critical importance of robust defensive measures. Common industry practices to mitigate these risks include implementing multi-factor authentication (MFA) to protect against the use of stolen credentials, maintaining strict network segmentation to prevent lateral movement, and conducting regular audits of access permissions. Furthermore, because the exposure of such data can lead to significant legal consequences, organizations must remain vigilant regarding local data protection regulations and the potential for legal proceedings following a breach.