Coremain targeted by ALPHV ransomware group in alleged data breach

• Ransomware group: ALPHV
• Country: Spain
• Sector: Technology
• Announcement date: July 26, 2023

ALPHV claims to have exfiltrated data from Coremain

The ALPHV ransomware group, also known as BlackCat, has claimed responsibility for a data breach involving the Spanish technology company Coremain. According to an announcement made on a leak site on July 26, 2023, the threat actor group alleges that they have successfully exfiltrated a significant amount of data from the organization's systems.

The group claims that the breach occurred as part of a cyber incident that took place on April 7, 2023. To support their claims of a successful intrusion and data theft, the attackers have published various images on their leak site. These images serve as evidence to demonstrate that they have gained access to sensitive internal files belonging to the organization.

Details of the alleged data theft

The threat actors claim to have stolen approximately 120 GB of data from Coremain's file servers. While the total volume of the data has been specified, the group has not provided a specific file count or a ransom demand. The nature of the breach involves the unauthorized access and removal of sensitive information from the company's infrastructure.

Based on the screenshots provided by the group, the leaked information includes samples of highly sensitive personal identification documents. The presence of such documents in a public leak poses significant risks to the individuals whose information was captured. The specific types of data identified in the leak include:

• Identity documents

The inclusion of these documents suggests that the attackers have targeted personal information that can be used for fraudulent purposes.

About Coremain

Coremain is a technology company based in Spain. The organization provides a variety of professional services, including digital transformation, software development, and IT consulting services. Their client base spans across both public and private sector organizations, providing essential technical support and digital solutions to various entities.

Impact and security implications

The alleged leak of personal identification data, such as passports and identity cards, significantly increases the risk of identity theft and targeted phishing attacks for the individuals affected by this incident. When sensitive documents are exposed, malicious actors can use the information to impersonate victims or craft highly convincing social engineering campaigns.

Furthermore, because Coremain is located in Spain, this incident may lead to regulatory consequences under the European Union's General Data Protection Regulation (GDPR). The exposure of personal data within the EU jurisdiction often triggers strict reporting requirements and potential legal scrutiny regarding data protection standards.

The ALPHV group is known for utilizing Rust-based ransomware and employing double-extortion tactics. In a double-extortion scenario, attackers not only encrypt the victim's data to disrupt operations but also threaten to leak the stolen data on public forums to pressure the organization into paying a ransom. This tactic places immense pressure on an organization's reputation and operational continuity.

For organizations in the technology sector, such incidents highlight the importance of robust security measures. To mitigate the risks associated with such attacks, companies often implement defensive strategies such as multi-factor authentication, regular security audits, and comprehensive data encryption. Additionally, maintaining strict access controls and monitoring for unusual data exfiltration patterns are critical steps in defending against sophisticated ransomware groups like ALPHV.