Clop ransomware group claims data breach against NOWFOODS.COM

• Ransomware group: clop
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: December 22, 2022

The clop ransomware group has announced a data breach involving NOWFOODS.COM. According to a post published on the group's dedicated leak site, the threat actors claim to have successfully targeted the organization and exfiltrated sensitive information from its systems.

The details of the alleged attack

The announcement regarding the targeting of NOWFOODS.COM was made by the clop group on December 22, 2022. In their public claim, the group alleges that they gained unauthorized access to the organization's internal systems. The group's post on their leak site specifies that the incident took place on December 22, 2022, the same day the announcement was made.

This type of activity is often associated with double extortion tactics used by modern ransomware groups. In such scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release private information on public leak sites, these groups aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or personal data.

Information regarding the leaked data

At this stage, there is no screenshot or detailed information available regarding the nature of the alleged leaked data. The listing provided by the group does not specify the types of files, the volume of data, or the specific categories of information that were purportedly compromised.

• No specific data types were named in the listing.

About NOW Foods

NOW Foods is a US-based health and wellness company that manufactures and sells vitamins, supplements, natural foods, and essential oils. Founded in 1968, the company offers a wide range of products in the natural products industry.

Analysis and industry implications

This incident may be consistent with the clop group's large-scale cyberattack campaigns targeting vulnerabilities in file transfer software. The group's association with TA505 suggests that the attack may involve high technical complexity and could potentially disrupt the organization's operational processes.

The potential leak of organizational data could create secondary risks such as identity theft or targeted phishing attacks for customers and employees. When sensitive information is exfiltrated, it can be used by malicious actors to craft highly convincing social engineering campaigns, making it difficult for individuals to distinguish between legitimate communications and fraudulent ones.

Given the sector in which the organization operates, a data breach could potentially trigger legal processes under relevant data protection regulations. Organizations in the retail and e-commerce sectors often handle significant amounts of consumer data, making them high-value targets for cybercriminals. To defend against such threats, organizations typically implement various security measures, including robust patch management to address software vulnerabilities, multi-factor authentication to secure access, and continuous monitoring of network traffic to detect unauthorized data exfiltration.