Cordogan Clark and Associates targeted by fog ransomware group

• Ransomware group: fog
• Country: United States
• Sector: Professional Services
• Announcement date: October 16, 2024

Fog ransomware group claims data breach at Cordogan Clark and Associates

The threat actor known as fog has published an announcement on its leak site claiming to have successfully exfiltrated a significant amount of data from Cordogan Clark and Associates. According to the claims made by the group, the breach involves a substantial volume of information belonging to the professional services firm.

The incident was officially announced on the group's leak site on October 16, 2024. The threat actor alleges that the attack occurred on the same day, October 16, 2024. While the group has claimed responsibility for the data theft, public information regarding the specific identity and operational details of the fog group remains limited.

Details of the alleged data exfiltration

The fog group claims to have obtained 107 GB of data from the systems of Cordogan Clark and Associates. The nature of the stolen information, as described in the leak site announcement, suggests a high level of sensitivity, potentially impacting both the organization's internal operations and its external relationships.

According to the information provided by the threat actor, the compromised data is said to include the following types of information:

• Personal employee data
• Client communication records
• HR data
• Non-disclosure agreements
• Social security numbers
• Driver's licenses
• Passport copies

The presence of such highly sensitive personal identifiers, such as social security numbers, driver's licenses, and passport copies, indicates that the breach may have significant implications for the privacy of the individuals involved.

About Cordogan Clark and Associates

Cordogan Clark and Associates is a design firm based in Chicago. The organization provides a wide range of professional services, including architecture, planning, interior design, and engineering. Their work spans across various critical sectors, such as education, healthcare, residential developments, and various public projects.

Potential impact and industry implications

The nature of the alleged compromised data may pose secondary risks, such as identity theft and targeted phishing attacks, for both employees and clients. Because the threat actor intends to publish the data, the organization may face significant financial and operational pressure. Furthermore, as the organization is based in the United States, it may be subject to legal proceedings under relevant state laws and federal data protection regulations.

Operating within the professional services sector, the organization could face significant reputational damage due to the potential exposure of client confidentiality and trade secrets. In such scenarios, the exposure of sensitive client communications and legal documents like non-disclosure agreements can undermine trust between the firm and its stakeholders.

In general, ransomware attacks often utilize a "double extortion" tactic, where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This strategy is designed to maximize the pressure on the victim to pay a ransom. To defend against such threats, organizations typically implement multi-layered security strategies, including robust backup solutions, strict access controls, and continuous monitoring of their network environments to detect unauthorized data movement.