BlackSuit ransomware group claims data leak against Pojoaque

• Ransomware group: BlackSuit
• Country: United States
• Sector: Government & Defense
• Announcement date: July 25, 2024

The BlackSuit ransomware group has officially announced a data leak claim against Pojoaque on their dedicated leak site. This announcement, posted on July 25, 2024, marks a significant escalation in the ongoing tension between the threat actor and the targeted organization. According to the post, the group claims to have successfully exfiltrated sensitive information and is now moving toward the public disclosure phase.

The details of the claim

The BlackSuit group alleges that the management of Pojoaque has failed to respond to their communications and has ignored their specific demands. This lack of engagement has prompted the group to escalate their tactics. The threat actors have issued a direct threat to publish sensitive data belonging to both the organization's employees and its various business partners.

The group has established a strict timeline for the organization to comply with their demands. According to the announcement, if Pojoaque does not contact the attackers within a 24-hour window, the group intends to release the stolen data publicly. This tactic is a hallmark of modern ransomware operations, where attackers use the threat of public exposure to pressure victims into meeting their demands.

The alleged stolen data

The information claimed to be stolen by the BlackSuit group is extensive and covers various sensitive categories. The group asserts that the breach includes highly confidential documentation that could impact the privacy and operations of the organization and its associates. The specific types of data mentioned in the claim include:

• Business contracts
• Contact details
• Passport copies
• Family details
• Medical examination records
• Financial payment records
• Construction blueprints

The breadth of this data suggests a significant breach of privacy, potentially involving highly personal information and critical business intelligence. The inclusion of medical and family details indicates that the attackers are targeting individual identities alongside corporate assets.

About Pojoaque

Pojoaque Pueblo is a self-governing Native American tribe located in New Mexico. The tribe maintains its own government structure and operates various commercial enterprises and public services within the region. Given its role in the region, the organization operates within the government and defense sector, managing diverse services and maintaining a complex administrative structure.

Implications and risks

The alleged leak carries substantial risks for the individuals involved. The exposure of sensitive personal data, such as passport copies and medical examination records, significantly increases the risk of identity theft and fraud for both employees and partners. Furthermore, the disclosure of such information could lead to serious legal consequences for the organization under United States data protection regulations.

From a strategic perspective, BlackSuit is assessed to be a successor to the Royal ransomware operation. This connection suggests a high likelihood that the group is employing double-extortion tactics, a method where attackers not only encrypt an organization's data but also threaten to leak it to maximize leverage. In such scenarios, the goal is to force payment by leveraging the threat of reputational damage and regulatory scrutiny.

Because Pojoaque operates within the government and defense sector, this incident could have broader negative implications for supply chain security. When organizations in critical sectors are compromised, the ripple effects can extend to partners and government entities that rely on their services. To mitigate these risks, organizations in similar sectors typically focus on robust data protection, strict access controls, and comprehensive incident response plans to address both encryption and data exfiltration threats.