Blackout ransomware group claims data breach at metal7.com

• Ransomware group: Blackout
• Country: Canada
• Sector: Manufacturing
• Announcement date: February 26, 2024

Blackout ransomware group targets metal7.com

The Blackout ransomware group has announced on its leak site that it has successfully breached the network of metal7.com. According to the claims made by the threat actors, the attackers have obtained approximately 10 GB of data from the organization. This announcement, made on February 26, 2024, follows an alleged attack that occurred on the same day.

The group has utilized a double extortion method, a common tactic in modern ransomware campaigns. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information to use as leverage. The threat of leaking stolen data serves as a secondary pressure mechanism to compel the victim into paying a ransom. While the specific ransom demand has not been disclosed in the announcement, the group has stated that the exfiltrated data may be released publicly if their demands are not met.

Details of the alleged attack

The Blackout group alleges that it gained unauthorized access to the internal network of metal7.com. Beyond simply infiltrating the perimeter, the threat actors claim to have encrypted several servers within the environment. Furthermore, the group asserts that they were able to delete backups, a move designed to prevent the organization from easily restoring its systems without paying the ransom. The attackers also claim to have extended their access to include various subsidiaries of the organization.

Information regarding the Blackout group remains limited in the public domain, making it difficult to ascertain the full scope of their operations or their specific motivations. The group's claim of deleting backups and targeting subsidiaries highlights an aggressive approach intended to maximize operational disruption and psychological pressure on the target organization.

Data and information involved

The data allegedly stolen by the Blackout group is described as containing a variety of sensitive organizational information. Based on the claims, the exfiltrated files include internal documents, financial reports, and employee data. To support their claims, the group provided a screenshot showing a sample financing offer document from Banque Nationale.

The specific types of affected data mentioned in the claim include:

• Internal documents
• Financial reports
• Employee data

The exposure of such diverse data sets poses significant risks. The theft of employee data can lead to identity theft or make individuals targets for highly specific phishing attacks. Additionally, the exposure of financial documents can reveal trade secrets and potentially damage the competitive standing of the organization.

About metal7.com

Metal7 is a Canadian company that specializes in the design and manufacture of high-performance equipment and components for the mining and metallurgical industries. The organization is particularly known for its expertise in producing wear-resistant parts, specifically those used in pelletizing plants.

Risk assessment and industry implications

This incident highlights the significant risks faced by organizations in the manufacturing sector. The claim of a data breach involving financial and operational information can lead to severe consequences. Because the organization is based in Canada, these potential breaches may fall under the regulatory oversight of the Personal Information Protection and Electronic Documents Act (PIPEDA).

The use of double extortion techniques presents a dual threat to organizations: it attacks both operational continuity through encryption and data privacy through exfiltration. When an organization's financial reports are leaked, it can result in the disclosure of sensitive trade secrets, which may harm its competitive advantage in the global market. Furthermore, the loss of employee information creates long-term liabilities regarding personal data protection.

To defend against such threats, organizations in the manufacturing and industrial sectors often focus on strengthening their defensive posture through several key areas. This includes maintaining offline or immutable backups to mitigate the impact of backup deletion, implementing strict network segmentation to prevent lateral movement to subsidiaries, and enhancing monitoring to detect unauthorized data exfiltration. As threat actors continue to target industrial supply chains, the ability to protect both operational technology and sensitive corporate data remains a critical priority for modern enterprises.