Centre du Sablon targeted by NoEscape ransomware group

• Ransomware group: NoEscape
• Country: Spain
• Sector: Government & Defense
• Announcement date: October 9, 2023

NoEscape claims a data breach at GEACAM

The ransomware group known as NoEscape has listed a significant amount of data on its leak site, claiming the information belongs to the Spanish public entity GEACAM. According to the announcement, which appeared on the group's leak platform on October 6, 2023, the threat actors claim to have successfully exfiltrated sensitive information from the organization.

The group's announcement follows a claimed attack date of October 1, 2023. NoEscape has stated that they have gained access to confidential and sensitive data belonging to the entity. The threat actor has issued a threat to leak the entire dataset if the organization does not establish contact with them. This tactic is a hallmark of modern ransomware operations, where the focus has shifted from merely encrypting files to stealing them to increase leverage over the victim.

Details of the alleged data theft

While the group has made a public claim regarding the breach, specific details regarding the contents of the stolen files remain limited. The group's listing indicates that approximately 71 GB of confidential and sensitive company data has been compromised. However, no specific list of data types has been provided by the attackers to clarify exactly what was taken during the intrusion.

The listing names no specific data types within the provided information.

The organization profile

The organization involved in this alleged incident is Centre du Sablon. Based in Laval, Canada, Centre du Sablon is a community center that provides various sports, cultural, and community-based events. The center aims to strengthen the social fabric by offering various activities and opportunities to the community it serves.

Potential risks and organizational impact

This alleged data breach may pose a significant risk to the operational continuity and data security of GEACAM, which functions as a public entity. Because the organization is based in Spain, a potential breach of this nature could lead to legal consequences under the EU General Data Protection Regulation (GDPR). If the stolen data includes personal information belonging to employees or citizens, secondary risks such as identity theft and targeted phishing attacks may occur.

The tactics employed by NoEscape appear to aim at increasing pressure on the organization through a double-extortion strategy. In a double-extortion scenario, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. This method is designed to force the victim to pay the ransom to prevent the reputational and legal damage associated with a data leak.

For organizations operating within the government and defense sectors, such threats highlight the importance of robust cybersecurity frameworks. Defensive measures often include maintaining offline backups, implementing strict access controls, and conducting regular security audits to detect unauthorized access early. Furthermore, maintaining a comprehensive incident response plan is essential for managing the legal and operational fallout that follows a confirmed data breach.

Summary of the claim

• Ransomware group: NoEscape
• Targeted organization: GEACAM
• Claimed data size: 71 GB
• Announcement date: October 6, 2023
• Claimed attack date: October 1, 2023