Clop ransomware group lists nowin##### on its leak site

• Ransomware group: Clop
• Country: United States
• Sector: Energy & Utilities
• Announcement date: December 24, 2024

Clop ransomware group claims data breach at Now Inc

The Clop ransomware group has officially announced that they allegedly possess data belonging to Now Inc. This claim was made via a listing on the group's leak site, marking a new potential target for the threat actors.

Details of the claim

On December 24, 2024, the Clop group listed Now Inc. on their dedicated leak site. According to the group's announcement, they claim to hold data from multiple companies that utilize Cleo software. The threat actors have stated that they are reaching out to the company for the purpose of providing access to a private chat channel to facilitate ransom negotiations.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These sites often host lists of compromised organizations and, in some cases, samples of stolen data to increase the pressure on the target. The group's claim suggests they are attempting to establish a direct line of communication with the organization to negotiate the terms of the incident.

Data involved in the incident

Regarding the specific content of the alleged breach, no specific details or screenshots regarding the content of the leaked data have been provided by the group.

• No data types were specified in the listing.

The lack of immediate information regarding the volume or nature of the files is common in the early stages of a leak site announcement. In many cases, threat actors withhold specific details to maintain leverage during the negotiation process.

About Now Inc

Now Inc. is an organization that specializes in supply chain management and the distribution of industrial products. Their operations serve the energy, industrial, and manufacturing sectors. Specifically, the company provides equipment and logistics solutions primarily to the oil and gas industry.

Analysis and industry implications

This claim appears consistent with the Clop group's history of conducting large-scale data theft campaigns by exploiting vulnerabilities in file transfer software. Given the company's operation in the energy and utilities sector, the breach may potentially involve critical infrastructure data or sensitive customer information. Because the company is based in the United States, this incident could lead to regulatory scrutiny under state laws and federal data privacy requirements.

The potential publication of data might expose employees and customers to various risks, such as identity theft or targeted phishing attacks. Based on the group's known tactics, it is possible that they are employing a double-extortion strategy to exert pressure on the organization. Double extortion is a tactic where attackers not only encrypt a victim's data to disrupt operations but also steal sensitive information to threaten its public release if the ransom is not paid.

For organizations operating within the energy and utilities sector, such incidents highlight the importance of robust cybersecurity frameworks. Protecting critical infrastructure requires continuous monitoring and the implementation of strict access controls. Organizations can take defensive steps such as maintaining regular, offline backups, implementing multi-factor authentication, and ensuring that all third-party software, particularly file transfer tools, is patched against known vulnerabilities. Furthermore, establishing a clear incident response plan is essential to mitigate the impact of potential data leaks and regulatory consequences.