CADRE listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: United States
• Sector: Professional Services
• Announcement date: October 19, 2023

ALPHV claims to have leaked data from CADRE

The ALPHV ransomware group has listed the US-based staffing services company CADRE on its leak site. According to the threat actors, the breach occurred on October 19, 2023, and involves a significant volume of sensitive information. The group claims to have exfiltrated over 100 GB of data allegedly belonging to the organization.

The incident follows what the threat actors describe as failed ransom negotiations. The group states that negotiations were conducted with the management of CADRE, but the company rejected a ransom demand of 35,000 USD. Following this rejection, the group announced that they would release the company's data for public download on their leak site.

Details of the alleged data leak

The data allegedly stolen during this incident is extensive and covers various sensitive categories. The information purportedly includes personal details of both job seekers and internal personnel. The contents of the alleged leak include the following:

• Job seeker contact details
• CVs
• IDs
• Drug screening results
• Employee contracts
• Social security numbers (SSN)
• Payment information
• I-9 form records

In addition to the personal identifiers and employment documents, the group claims that the breach includes data originating from ADB Ultrastaff and Smartsearch software. This suggests that the attackers may have gained access to specialized recruitment and management platforms used by the company.

About CADRE

CADRE Services is a staffing and recruitment services company based in Wisconsin, United States. The company specializes in processing job seekers' data and assisting them in finding employment opportunities.

Risk assessment and implications

The exposure of such a wide array of sensitive information carries significant risks. The alleged leak of identity documents, social security numbers, and payment information may increase the risk of identity theft and fraud for both employees and job seekers. For an organization operating within the United States, the exposure of this type of data could lead to legal repercussions under both state laws and federal regulations.

Furthermore, the disclosure of sensitive personal information may cause reputational damage and expose the entity to long-term legal proceedings. This incident may also pose secondary risks to the company's supply chain partners, as the breach of a service provider often impacts the ecosystem of businesses they interact with.

The ALPHV group, also known as BlackCat, is known for utilizing double-extortion tactics. This method involves both the exfiltration of data and the demand for ransom, using the threat of public data disclosure to pressure victims into paying. To defend against such threats, organizations in the professional services sector typically focus on robust data encryption, strict access controls, and continuous monitoring of their networks to detect unauthorized exfiltration attempts.