Borrer Executive Search listed on leak site by apt73

• Ransomware group: apt73
• Country: Switzerland
• Sector: Professional Services
• Announcement date: June 13, 2024

The threat actor group known as apt73 has listed the Switzerland-based organization Borrer Executive Search on its leak site. According to the announcement made on June 13, 2024, the group claims to have successfully breached the company's systems and obtained sensitive information.

The claimed attack event

The threat actor group apt73 claims to have obtained data belonging to Borrer Executive Search. According to the group's announcement, the breach occurred on June 13, 2024. The group has subsequently listed the files on their dedicated leak site as part of their public disclosure. While the group has made these claims, it is important to note that information regarding the specific identity and background of apt73 remains limited in the public domain.

In many modern cyberattacks, threat actors utilize leak sites to exert pressure on victims. This tactic is often associated with double extortion, where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. By publishing data on a leak site, attackers aim to damage the victim's reputation or force compliance with ransom demands. In this specific instance, no ransom demand has been specified by the group.

The data allegedly involved in the leak

The content of the alleged leak includes a variety of sensitive corporate information. Based on the information provided by the threat actor, the data includes internal documents, agreements, and various samples of invoices. Furthermore, screenshots provided by the group appear to display documents that contain the company's commercial registration details and samples of signatures.

The specific types of data identified in the listing include:

• Internal communications
• Agreements
• Commercial registration documents
• Signature samples
• Invoice details

The size of the data involved in this alleged leak is reported to be 2.5MB. No specific file count was provided in the announcement.

Implications and risks for the sector

The alleged leak of corporate agreements and signature samples may increase the risk of identity theft or fraud for both the company and its clients. Because the leaked data contains sensitive identifiers such as signature samples and commercial registration details, it provides malicious actors with the tools necessary to impersonate company officials or forge documents.

Given that the company is located in Switzerland, this incident may result in legal consequences under the General Data Protection Regulation (GDPR) and local data protection regulations. For organizations operating in the professional services sector, such breaches pose a significant risk. The leaked data could potentially be leveraged by attackers to conduct supply chain attacks, where the compromised organization is used as a stepping stone to reach their clients or partners.

Furthermore, the publication of such data can lead to severe reputational damage and the erosion of trust between the company and its clients. To mitigate such risks, organizations in the professional services sector often implement defensive measures such as multi-factor authentication, rigorous access controls, and continuous monitoring of internal communications and document repositories. Maintaining robust data encryption and regular security audits are also common industry practices to protect against the unauthorized exfiltration of sensitive corporate assets.