BULOG listed on Ransomexx leak site

• Ransomware group: Ransomexx
• Country: Indonesia
• Sector: Agriculture and Food Production
• Announcement date: February 22, 2023

Indonesian food logistics company targeted by Ransomexx

The Ransomexx threat actor group has listed the Indonesian state-owned enterprise BULOG on its dedicated leak site. According to the announcement made on February 22, 2023, the group claims to have successfully exfiltrated data belonging to the organization. This development follows a pattern often seen in modern cyberattacks where threat actors use public leak sites to pressure victims by threatening to release sensitive information.

In many ransomware campaigns, actors employ a strategy known as double extortion. In this scenario, the attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data before the encryption process begins. By threatening to publish this stolen information on a public forum, the group increases the leverage they hold over the victim, hoping to coerce them into paying a ransom to prevent the data from becoming public knowledge.

Details of the claimed data theft

The Ransomexx group has published a claim regarding the breach, asserting that the attack occurred on February 22, 2023. The announcement includes a file list that provides specific details regarding the volume of the data the group claims to have acquired. According to the information shared by the threat actor, the stolen data is organized into multiple parts to facilitate access.

The specific details provided in the leak site announcement regarding the stolen data include the following:

• Total data size of 12.77 GB
• Data divided into 27 parts

The group has also provided a download password alongside the announcement, which indicates that the data is currently accessible for download. While the presence of a password and a file list confirms the group's intent to distribute the information, no specific details regarding the nature or the content of the leaked data have been provided in the announcement. The screenshot from the leak site confirms the file count and size but does not elaborate on the specific types of files or the categories of information contained within the 27 parts.

About BULOG

BULOG is an Indonesian state-owned enterprise that plays a critical role in the nation's food security and logistics infrastructure. The organization is primarily engaged in food logistics and holds significant responsibilities regarding the procurement and distribution of essential goods. Furthermore, BULOG is tasked with the price stabilization of staple food commodities, making its operational continuity and data integrity vital to the regional food supply chain.

Potential risks and industry implications

This leak may pose a significant risk of exposure for the organization's operational data and sensitive information. Given the strategic position of BULOG within the food logistics sector, the disclosure of information regarding supply chain processes could lead to secondary risks. For organizations operating within critical infrastructure or essential supply chains, the loss of data can disrupt the flow of goods and impact economic stability.

The public availability of such data may facilitate targeted phishing attacks against employees and business partners. When attackers possess internal information, they can craft highly convincing social engineering campaigns to gain further access to corporate networks or to defraud partners. Such attacks often exploit the trust established between a company and its stakeholders.

While public information regarding the Ransomexx group remains limited, the incident highlights the ongoing threat posed by ransomware groups to large-scale logistics entities. Organizations facing similar threats may need to initiate investigations under local data protection regulations and may be required to notify the affected parties. General defensive measures for organizations in this sector often include implementing robust data encryption, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of social engineering.