CannonDesign listed on Dunghill leak site following claims of a massive data breach

• Ransomware group: Dunghill
• Country: United States
• Sector: Professional Services
• Announcement date: September 26, 2023

Dunghill claims to have stolen 2 TB of data from CannonDesign

The threat actor known as Dunghill has published an announcement on its leak site, claiming to have leaked 2000 GB of data belonging to CannonDesign. This announcement, made on September 26, 2023, alleges a significant data breach targeting the organization's infrastructure. To support the claim of the breach, the threat actor provided a small archive file as alleged proof.

The incident follows a common pattern observed in modern cyberattacks, particularly those involving ransomware groups. In many such cases, threat actors employ a technique known as double extortion. This method involves not only encrypting an organization's systems to disrupt operations but also exfiltrating sensitive data to use as leverage. By threatening to release stolen information on public leak sites, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information.

Details of the alleged data exfiltration

According to the claim made by the Dunghill group, the stolen data is extensive, totaling 2000 GB. The leaked content is said to include a wide variety of sensitive information that could impact various aspects of the organization's operations. The announcement specifically mentions the following types of data as being part of the breach:

• Databases (including Argos7, cd-estimating02, cd-cortexsql01, cd-ostakeoff, cd-tipsqlprod, cd-intsql01, etc.)
• Work files
• Project records
• Hiring data
• Client documents
• Marketing materials
• Quality documents
• IT infrastructure information

The inclusion of specific database names and IT infrastructure details suggests that the attackers may have gained deep access into the organization's internal systems. Such information is highly sensitive as it can provide a roadmap for further malicious activity.

About CannonDesign

CannonDesign is a global architecture, engineering, and consulting firm that provides services for various sectors, including hospitals, educational facilities, corporate headquarters, and sports complexes. Known for its innovative designs, the company develops projects for a wide range of industries worldwide.

Potential impact and organizational risks

This breach claim suggests that sensitive corporate data and client information within CannonDesign may be at risk of exposure. The alleged theft of IT infrastructure information is particularly concerning, as it could potentially leave the organization more vulnerable to future cyberattacks by providing attackers with technical insights into their environment. Furthermore, the exposure of client and project data may damage the organization's commercial reputation and could trigger legal processes under relevant data protection regulations.

The content of the alleged data may be significant enough to impact the organization's operational continuity. For organizations operating in the professional services sector, the loss of project records and client documents can disrupt long-term business relationships and ongoing operations. While information about the Dunghill group remains limited, the scale of the claimed theft highlights the growing risks faced by global firms.

To mitigate such risks, organizations typically implement defensive strategies such as robust encryption for data at rest and in transit, multi-factor authentication (MFA) across all access points, and continuous monitoring of network traffic to detect unusual data exfiltration patterns. Regular security audits and comprehensive incident response plans are also essential components of a modern cybersecurity posture to manage the fallout of potential breaches.