CannonDesign targeted by avoslocker ransomware group

• Ransomware group: avoslocker
• Country: United States
• Sector: Professional Services
• Announcement date: February 11, 2023

The avoslocker ransomware group has announced a significant data breach involving CannonDesign. According to a notice posted on a leak site on February 11, 2023, the threat actor claims to have exfiltrated 5.7 TB of data from the organization.

The claimed attack and extortion attempt

The threat actor has published a data leak notice specifically targeting CannonDesign. The group asserts that the release of stolen information is a direct consequence of non-compliance with their demands. While the specific ransom demand has not been disclosed, the group has stated that corporate and client files may be released if their requirements are not met.

This type of activity is characteristic of modern ransomware tactics known as double extortion. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information before the encryption phase. The threat of leaking this data on public or private leak sites serves as additional leverage to pressure the victim into paying a ransom. By threatening to expose confidential files, the attackers aim to cause reputational damage and legal consequences for the organization.

Data involved in the breach

The information reportedly stolen during the incident is substantial in volume. The group claims that the exfiltrated data includes sensitive personal information belonging to executives. This data is highly sensitive and could be utilized for various malicious purposes.

The listing identifies the following affected data types:

• Corporate files
• Client files
• Executive personal data, including names, addresses, birth dates, and SSNs

The presence of Social Security Numbers (SSNs) and other personally identifiable information (PII) significantly elevates the severity of the breach. Such data is a primary target for identity theft and fraudulent activities.

About CannonDesign

CannonDesign is a global design firm that provides a wide range of professional services. Their expertise includes architecture, engineering, interior design, and planning services. The company is involved in developing projects across several diverse sectors, such as healthcare, education, science, and technology.

Analysis and potential implications

The nature of the exfiltrated data presents significant risks to both the company and its high-level executives. The theft of personal details like addresses and SSNs may lead to identity theft risks. Furthermore, the sheer volume of data and the types of files involved could potentially impact the company's ongoing operations and its professional relationships with clients.

Because CannonDesign is a United States-based entity, this incident may result in legal implications under relevant regulations and state-level data privacy laws. Beyond the immediate impact, there are secondary risks to consider, such as the potential for targeted phishing attacks that utilize the leaked executive information to deceive employees or clients.

For organizations operating in the professional services sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive strategies often include implementing multi-factor authentication, maintaining rigorous data encryption protocols, and conducting regular employee training to recognize phishing attempts. Additionally, maintaining offline, immutable backups is a critical component of a resilient defense against ransomware. As public information regarding the avoslocker group remains limited, organizations must remain vigilant against evolving threats from such actors.