core.touch-ins.co.il listed on Toufan ransomware leak site

• Ransomware group: Toufan
• Country: Israel
• Sector: Technology
• Announcement date: December 19, 2023

The threat actor known as Toufan has claimed to have compromised data belonging to core.touch-ins.co.il. This claim was made via a listing on the group's leak site, signaling a potential data breach involving the organization.

The claims made by Toufan

On December 19, 2023, the Toufan group officially listed core.touch-ins.co.il on its dedicated leak site. Through this announcement, the threat actor alleges that it has successfully gained unauthorized access to the organization's data. While the group has made this public claim, it is important to note that public information regarding the specific activities and identity of the Toufan group remains limited.

Ransomware leak sites are platforms used by cybercriminals to pressure victims into paying ransoms. In many modern cyberattacks, threat actors employ a tactic known as double extortion. In these scenarios, attackers do not just encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data. The threat of leaking this stolen information on a public site serves as additional leverage to compel the organization to meet the attackers' demands.

Details regarding the alleged data breach

At this stage, the information provided by the threat actor is minimal. The listing does not provide any screenshots or detailed information regarding the specific nature of the leaked data. Furthermore, no information has been provided regarding the total size of the data, the specific file count, or the amount of the ransom demand.

The listing names no specific data types that have been compromised.

About core.touch-ins.co.il

Touch Insurance is an Israel-based technology and insurance solutions company. The organization provides digital platforms and software services specifically designed for the insurance industry.

Implications and organizational risks

This claim suggests that the security of the organization's digital assets may have been compromised. Depending on the actual content of the leaked data, several secondary risks may arise for the organization's employees and customers, such as identity theft or targeted phishing attacks. Such attacks often follow a breach, as criminals use stolen credentials or personal details to deceive individuals.

Because the organization is based in Israel, any potential data breaches may be subject to local data protection regulations. Furthermore, the threat actor's intent to publish the data could lead to significant reputational damage and operational disruptions for the organization.

To defend against such threats, organizations in the technology and insurance sectors typically focus on several defensive layers. This includes implementing robust access controls to ensure only authorized personnel can reach sensitive data, maintaining rigorous patch management to close vulnerabilities, and conducting regular security awareness training to help employees recognize phishing attempts. Additionally, maintaining comprehensive logs and monitoring network traffic can help organizations detect unauthorized access more quickly, potentially mitigating the impact of a breach before data can be exfiltrated.