COSI targeted by Karakurt ransomware group

• Ransomware group: Karakurt
• Country: United States
• Sector: Education
• Announcement date: August 2, 2023

Karakurt claims data breach at COSI

The threat actor known as Karakurt has published a leak announcement on its platform, claiming to have compromised significant amounts of data belonging to COSI. According to the announcement, the group asserts that it has successfully exfiltrated approximately 75 GB of information from the organization's systems.

The claim was made on August 2, 2023, which also matches the date the group alleges the attack took place. While the group has publicized this breach, public information regarding the specific methods and background of the Karakurt group remains limited. This type of announcement is a common tactic used by ransomware groups to exert pressure on victims, a method often referred to as double extortion, where stolen data is used as leverage alongside encryption.

Details of the alleged data theft

The Karakurt group alleges that the stolen data is extensive and covers various sensitive areas of the organization's operations. The group claims that the compromised information includes a wide range of internal documents and sensitive records. While the specific file count has not been disclosed, the volume of the data is estimated to be 75 GB.

The allegedly leaked data includes the following categories of information:

• Project information
• Financial documents
• Contracts
• Client contact details
• Donation information
• Employee data
• Transaction records
• Correspondence

The presence of such diverse data types suggests a broad compromise of the organization's digital environment, ranging from administrative and financial records to personal information belonging to staff and clients.

About COSI

COSI (Center of Science and Industry) is an interactive science museum and educational center located in Columbus, Ohio. It serves as a significant cultural and educational hub, providing scientific exhibitions, educational programs, and workshops designed for visitors of all ages.

Potential impact and risks

The alleged data leak presents several significant risks to the institution. The nature of the data involved, which includes employee and client information, could lead to secondary risks such as identity theft and targeted phishing attacks against the individuals involved. Furthermore, because the institution operates within the United States, the breach may trigger legal processes under state-level data protection laws and regulatory requirements, depending on the specific nature of the compromised data.

From a commercial perspective, the exposure of financial and contractual documents could have a negative impact on the institution's reputation. Given the known patterns of the Karakurt group, there is a possibility that the data may be released publicly or used to increase pressure for ransom demands in the future.

In general, organizations in the education and non-profit sectors face evolving threats from ransomware groups. To mitigate such risks, it is standard practice for institutions to implement robust defensive measures. These typically include maintaining offline backups, implementing multi-factor authentication across all systems, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, monitoring network traffic for unusual data exfiltration patterns can help in detecting such incidents before large volumes of data are successfully stolen.