CONEX listed on Nokoyawa ransomware leak site

• Ransomware group: Nokoyawa
• Country: France
• Sector: Professional Services
• Announcement date: May 23, 2023

Nokoyawa ransomware group claims attack on CONEX

The Nokoyawa ransomware group has posted an announcement on its leak site claiming to have targeted CONEX, a technology company based in France. According to the post made on May 23, 2023, the group alleges that the organization was breached, and they have provided a data package for download. While the group has made these claims, information regarding the specific identity and operations of the Nokoyawa group remains limited in the public domain.

Ransomware attacks of this nature often follow a pattern of double extortion, where threat actors not only encrypt an organization's internal systems to disrupt operations but also exfiltrate sensitive data. By threatening to release this stolen information on a public leak site, the attackers aim to exert maximum pressure on the victim to meet ransom demands. In such scenarios, the visibility of the leak serves as a tool for extortion, often targeting the reputation of the company and its professional relationships.

Details of the alleged data breach

The announcement provided by the Nokoyawa group includes certain technical details regarding the alleged theft. The group claims that the attack occurred around January 20, 2023. Regarding the volume of information involved, the group asserts that the leaked data package is approximately 189.8 MB in size. No specific details regarding the exact content or the specific types of files contained within this data package were provided in the announcement.

The listing names no specific data types or individual files that were allegedly stolen. However, given the nature of the organization's business model, the potential contents of such a leak are a matter of concern for the industry. The lack of transparency from the attackers regarding the specific files makes it difficult to immediately assess the exact scope of the sensitive information involved.

About CONEX

CONEX is a technology company that specializes in providing software solutions designed for the management of customs procedures. The organization operates a SaaS-based modular platform, which is utilized for the processing of customs declarations. Furthermore, their technology facilitates the interconnection processes required to work with various customs administrations. Because of this role, the company plays a functional part in the digital workflows of customs management.

Potential risks and industry implications

The alleged leak poses significant risks to operational continuity, particularly because CONEX operates in the critical field of customs management. Because the organization provides a SaaS platform that connects with customs administrations and manages declarations, the potential misuse of leaked data by third parties could lead to secondary risks. These risks might include targeted phishing campaigns or identity theft attempts directed at the organization or its partners.

Depending on the specific contents of the data, the breach could impact the organization's connections with its clients and the various customs administrations it serves. Furthermore, depending on the specific regions in which the organization operates, such an incident may trigger legal processes under data protection regulations, such as the General Data Protection Regulation (GDPR). For organizations operating in critical infrastructure or highly regulated sectors like customs and logistics, maintaining robust defensive measures is essential. This includes implementing strict access controls, continuous monitoring of network traffic, and ensuring comprehensive data encryption to mitigate the impact of potential exfiltration events.