Carruth Compliance Consulting listed on Skira ransomware leak site

• Ransomware group: Skira
• Country: United States
• Sector: Financial Services
• Announcement date: March 6, 2025

The threat actor group known as Skira has announced the alleged exfiltration of approximately 469 GB of data belonging to Carruth Compliance Consulting. The announcement, made on March 6, 2025, indicates that the organization's information has been targeted in a data breach incident.

The Skira group claims to be selling stolen data

The Skira group has listed Carruth Compliance Consulting on its leak site, claiming that the company's data is currently for sale. According to the threat actor, the group has obtained various sensitive information, including databases and website source code. This type of activity is characteristic of double extortion tactics, where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage during ransom negotiations.

The announcement indicates that the data is currently available for purchase on the group's leak site. At the time of the announcement, no specific publication date for the data has been set, meaning the threat actor has not yet committed to a timeline for releasing the information publicly if the demands are not met.

Details of the allegedly stolen information

The dataset claimed by the Skira group is substantial in size, totaling approximately 469 GB. The threat actor asserts that the stolen information is highly sensitive and includes a wide variety of personal and corporate data. The contents of the alleged breach are reported to include databases and website source code, alongside a range of personally identifiable information (PII) and financial documentation.

The specific items listed as being part of the stolen dataset include:

• Social Security numbers
• Financial account information
• Driver's license numbers
• W-2 tax forms
• Medical billing information
• Tax filings

The inclusion of such diverse data types suggests a high level of sensitivity regarding the information the group claims to possess.

About Carruth Compliance Consulting

Carruth Compliance Consulting is a financial consulting firm specializing in the administration and compliance of 403(b) and 457(b) retirement plans. It primarily provides retirement plan administrative services for educational institutions and public sector employees. Given its focus on retirement plan administration, the firm handles significant amounts of sensitive financial and personal information for its client base.

Potential impact and industry implications

This incident may pose risks of identity theft and financial fraud for the company's employees and clients. The nature of the allegedly leaked data, which includes Social Security numbers and financial account information, may increase the potential for targeted phishing attacks against the affected individuals.

Given that the entity is based in the United States, the breach could lead to legal consequences under state-level data protection laws and federal regulations. Organizations operating within the financial services sector often face stringent regulatory requirements regarding the protection of sensitive client data and the timely reporting of breaches.

While public information regarding the Skira group is limited, this incident highlights the ongoing risks faced by financial services providers. In such scenarios, organizations may need to initiate data breach notification procedures and inform the affected parties to mitigate potential harm. General defensive measures for organizations in this sector typically include implementing robust encryption, multi-factor authentication, and continuous monitoring to detect unauthorized access to sensitive databases and source code.