Brolly targeted by killsec ransomware group

• Ransomware group: killsec
• Country: United Kingdom
• Sector: Technology
• Announcement date: February 19, 2025

Killsec claims to have breached Brolly

The threat actor known as killsec has published an announcement on their leak site claiming to have breached the organization Brolly. According to the group's post, they have compromised the organization's data and are demanding a ransom payment of 5,000 EUR in exchange for the information. The listing provided by the group also includes a link to a sample of the allegedly compromised data.

The claim was announced on February 19, 2025, with the group asserting that the attack occurred on the same day. This type of announcement is a common tactic used by ransomware groups to pressure victims into paying ransoms by demonstrating that they have successfully accessed sensitive information.

Details of the alleged incident

The killsec group has officially targeted Brolly through a listing on their dedicated leak site. While the group claims to have successfully compromised the organization's data, they have not provided specific details regarding the exact content of the leaked data. The announcement serves as a public claim of a successful breach and a demand for financial compensation.

The listing names no specific data types that have been compromised.

About Brolly

Brolly is a technology company based in South Africa that provides digital solutions and software services specifically for the insurance industry. The organization focuses primarily on the management and digitization of insurance policies, providing essential digital tools for the sector.

Risk assessment and industry implications

This incident may pose a significant risk to the confidentiality and security of the organization's customer data. If the data is ultimately published by the threat actor, affected individuals could be exposed to various risks, such as identity theft or targeted phishing attacks. Because the organization is based in the United Kingdom, a potential data breach of this nature could lead to legal consequences under the UK GDPR framework.

The killsec group is known to have hacktivist origins and provides ransomware-as-a-service, which suggests that the group may employ secondary extortion tactics. In such scenarios, attackers often move beyond simple encryption to pressure victims through the threat of leaking sensitive information publicly.

For organizations operating within the technology and insurance sectors, maintaining robust security postures is critical. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security audits to identify vulnerabilities. Protecting customer and operational data is paramount to maintaining trust and ensuring compliance with regional data protection regulations.

General context on ransomware tactics

Ransomware leak sites are platforms used by cybercriminals to host announcements regarding successful attacks. These sites often serve as a tool for public shaming, where the attackers list the names of the victim organizations and provide evidence of the stolen data to increase pressure on the target. This method is a core component of modern extortion strategies.

Double extortion is a tactic where attackers not only encrypt an organization's systems but also steal sensitive data. The threat actors then threaten to release this data on a leak site if the ransom is not paid. This increases the leverage held by the attackers, as the victim faces not only operational downtime but also significant reputational damage and legal liability if the data is exposed.