City of Modesto targeted by Nokoyawa ransomware group

• Ransomware group: Nokoyawa
• Country: United States
• Sector: Government & Defense
• Announcement date: May 23, 2023

Nokoyawa group claims data breach at City of Modesto

The Nokoyawa ransomware group has published a claim on its leak site involving the City of Modesto. According to the group's announcement, they have successfully exfiltrated a significant amount of data belonging to the municipal government entity, totaling 80 GB in size.

The group alleges that they gained unauthorized access to the networks belonging to the City of Modesto. Following the initial breach, the attackers reportedly demanded a ransom payment of 700,000 USD to prevent the release of the stolen information. The group further claims that the institution rejected a counter-offer of 195,000 USD, a decision that allegedly led to the subsequent public disclosure of the data on the group's leak site.

Details of the alleged data exfiltration

The leaked information is said to consist of 80 GB of archive files. The contents of these archives are claimed to include highly sensitive information that could impact both the institution and its personnel. The group alleges that the stolen data contains various types of personal and technical information, including:

• Employee personal data
• CVs
• Driver's licenses
• Social security numbers
• Network credentials

The inclusion of network maps containing credentials for both local and remote services suggests that the breach may provide attackers with a blueprint of the organization's internal architecture. This type of information is particularly sensitive as it can facilitate further unauthorized access or lateral movement within a network.

Organization profile

Modesto serves as the county seat of Stanislaus County in the U.S. state of California. As a municipal government entity, the city is responsible for providing various local public services to its community.

Risk assessment and implications for the public sector

The alleged leak poses a significant risk to the staff of the institution due to the exposure of sensitive personal information. The disclosure of highly sensitive identifiers, specifically social security numbers and driver's licenses, significantly increases the potential risk of identity theft for the affected individuals. Such identity theft can lead to long-term financial and legal complications for the victims.

Furthermore, the publication of network maps and credentials poses a secondary risk to the institution's infrastructure. These technical details could be leveraged by other threat actors to launch subsequent attacks against the city's digital environment. For organizations operating in the public sector, such breaches can also lead to legal consequences regarding local regulations and established data protection standards.

This incident highlights the growing trend of double extortion in ransomware attacks. In these scenarios, threat actors do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage for extortion. By threatening to leak data on public forums or leak sites, attackers increase the pressure on the victim to pay the ransom. This tactic is designed to bypass traditional backup and recovery strategies, as the threat shifts from data availability to data confidentiality.

To defend against such threats, organizations in the government and public service sectors often implement various defensive measures. These include robust network segmentation to limit lateral movement, multi-factor authentication (MFA) to protect credentials, and comprehensive monitoring to detect unauthorized access early. Additionally, maintaining strict data minimization practices and ensuring that sensitive employee information is encrypted can help mitigate the impact if a breach does occur. Information regarding the specific capabilities and methods of the Nokoyawa group remains limited at this time.