Clop ransomware group lists ALLEGIANTAIR.COM on its leak site

• Ransomware group: Clop
• Country: United States
• Sector: Transportation
• Announcement date: July 19, 2023

Clop claims access to Allegiant Air systems

The Clop ransomware group has officially announced the listing of ALLEGIANTAIR.COM on their dedicated leak site. This announcement, made on July 19, 2023, marks a significant development in the ongoing threat landscape facing the transportation sector. The threat actors associated with the Clop group claim to have successfully gained access to the internal systems of the organization.

The group's announcement serves as a public claim of a successful breach. In such scenarios, ransomware groups often utilize leak sites to exert pressure on their targets. These platforms host lists of victim organizations, sometimes accompanied by screenshots or data samples, to demonstrate the validity of their claims and to facilitate extortion efforts. In this specific instance, the information provided by the group is limited to the initial listing of the organization.

Details regarding the claimed event

According to the claims made by the Clop threat actors, the organization was added to their list of victims on July 19, 2023. While the group asserts that they have obtained access to the organization's systems, the specific details regarding the nature of the intrusion remain undisclosed. The evidence provided by the group consists of a screenshot that displays a verification page used for accessing the leak site. This screenshot acts as a gateway for those seeking to view the contents of the leak site but does not provide specific details regarding the compromised data or the extent of the unauthorized access.

Information regarding compromised data

At this stage, there is no information available regarding the nature of the compromised data. The listing does not specify the types of files, the volume of data, or the specific databases that may have been targeted during the alleged intrusion. The provided screenshot shows only a verification screen belonging to the leak site, which does not offer any insight into the actual content of the breach.

• No specific data types have been named in the listing.

Organization profile

Allegiant Air is a United States-based low-cost airline. The company primarily operates scheduled flights from small and medium-sized cities to popular vacation destinations.

Analysis and industry implications

Considering the past activities of the Clop group, this situation may pose a risk to the organization's data privacy. The group is known for its association with TA505, and such claims are generally considered part of a double extortion strategy. Double extortion is a tactic where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the pressure to pay the ransom.

In the transportation sector, where the organization operates, a potential leak of customer and employee data could lead to secondary risks such as identity theft and phishing attacks. Furthermore, as a US-based organization, a potential data breach could trigger notification obligations under relevant state laws and federal regulations. The group's tendency to exploit vulnerabilities in file transfer software suggests that the attack may have been carried out via the supply chain.

For organizations in the transportation and logistics sectors, maintaining robust security postures is critical. This includes implementing strict patch management for all software, particularly file transfer protocols, and monitoring for unauthorized access to sensitive systems. Strengthening supply chain security and ensuring that third-party vendors adhere to rigorous cybersecurity standards are also essential defensive steps to mitigate the risk of such attacks.