Barry Plant listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Australia
• Sector: Retail & E-Commerce
• Announcement date: September 5, 2023

ALPHV claims data breach at Barry Plant

The ALPHV ransomware group has listed the Australian real estate firm Barry Plant on its leak site. According to the group's announcement, the listing occurred on September 5, 2023, which also coincides with the date they claim the attack took place. The threat actor group has stated that they have released the data belonging to the organization following unsuccessful negotiations with the company.

Ransomware groups often utilize leak sites to exert pressure on victims through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's internal systems but also exfiltrate sensitive information to use as leverage. If the victim refuses to pay the ransom, the attackers threaten to publish the stolen data publicly to cause reputational and legal damage. This method increases the pressure on companies to comply with financial demands to prevent the exposure of private information.

The ALPHV group claims that the compromised information originated from the company's file server. According to the group's claims, the total volume of the stolen data is approximately 3.2 TB. No information was provided regarding the specific ransom demand or the exact file count involved in the incident.

Details of the alleged data leak

The data allegedly exfiltrated by the ALPHV group is described as containing a wide variety of sensitive files. The group claims that the dataset includes various personal and corporate documents that could be highly damaging if released. The specific types of data mentioned in the listing include:

• Email PST dumps
• Non-disclosure agreements (NDAs)
• Property application forms
• Criminal records
• Passports
• Identification documents

The exposure of such highly sensitive personal information, particularly passports and identification documents, significantly increases the risk of identity theft for the individuals whose data was allegedly taken. When identity documents are leaked, they can be used by malicious actors to commit fraud, open unauthorized accounts, or conduct other forms of social engineering and secondary cyberattacks.

About Barry Plant

Barry Plant is a well-established real estate group operating in Victoria and South Australia. The company offers a range of services including real estate sales, property management, and financial services. With nearly 40 years of experience, the company provides professional solutions in the residential and commercial real estate sector through its extensive network of offices.

Impact and industry implications

The alleged breach carries significant risks for the affected organization. Given that Barry Plant operates within Australia, the exposure of customer and employee data may lead to legal and regulatory consequences under the Privacy Act 1988. Beyond the legal implications, the loss of sensitive data can result in substantial reputational damage and long-term issues regarding institutional trust.

The ALPHV group is known for using Rust-based ransomware operations, which have historically resulted in large-scale data breaches. Such incidents often serve as a source for further, secondary cyberattacks against the victims or the individuals whose data was compromised. For organizations in the real estate and retail sectors, which handle vast amounts of personally identifiable information (PII), such breaches highlight the critical importance of robust cybersecurity frameworks.

To mitigate these risks, organizations typically focus on defensive strategies such as implementing multi-factor authentication (MFA), maintaining offline backups, and conducting regular security awareness training for employees. Furthermore, strict access controls and encryption of sensitive data at rest and in transit are essential components of a modern security posture to prevent unauthorized exfiltration of high-value assets like identity documents and financial records.