bnm.bg listed on Ransomed leak site with ransom demand

• Ransomware group: Ransomed
• Country: Bulgaria
• Sector: Financial Services
• Announcement date: September 26, 2023

Ransomed group targets bnm.bg

The entity bnm.bg has been listed on a leak site by the Ransomed group, accompanied by a ransom demand. This announcement, which appeared on September 26, 2023, indicates that the organization has been targeted in a cyberattack involving extortion.

Ransomware attacks often follow a pattern known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The attackers then threaten to leak this data on public platforms if the victim fails to meet their financial demands. This tactic increases the pressure on the target, as the threat of data exposure can lead to significant reputational and legal consequences.

The claims made by Ransomed

The Ransomed group claims to have obtained data belonging to bnm.bg. According to the threat actor, they are in possession of information that they intend to use as leverage. The group has stated that they will leak all the information in their possession if the ransom demand is not met.

The group has set a ransom demand of 14,000 USD. The announcement was published on September 26, 2023, which is the same date the group claims to have carried out the attack. While the group has made these claims, the information regarding the group itself remains limited in the public domain.

Details regarding the alleged leaked data

No information regarding the nature of the alleged leaked data has been provided. Furthermore, there is no screenshot available to verify the contents of the data or the claims made by the group. The listing names no specific data types.

About bnm.bg

BNM is a financial services and currency exchange business based in Bulgaria. The company provides foreign currency exchange services, operating within the financial services sector.

Risk assessment and implications

This incident suggests that the institution may face the risk of exposure of its financial and operational data. If the data is leaked, secondary risks such as identity theft and fraud may arise for the institution's clients. Because the organization is based in Bulgaria, a potential data breach may lead to legal sanctions under the EU General Data Protection Regulation (GDPR).

When organizations in the financial services sector face such threats, the potential impact can be broad. The exposure of operational data can disrupt business continuity, while the exposure of client-related information can lead to direct harm to individuals. Organizations typically look toward various defensive measures to mitigate such risks, such as implementing robust encryption, maintaining strict access controls, and ensuring regular backups are stored offline to prevent total data loss during an encryption event.

As of the current observation, there is a possibility that the data could be shared on public platforms if the ransom demand is not satisfied. The lack of public information regarding the Ransomed group makes it difficult to determine the specific motivations or the typical patterns of this actor beyond the current extortion attempt.