Coswell listed on metaencryptor ransomware leak site

• Ransomware group: metaencryptor
• Country: Italy
• Sector: Manufacturing
• Announcement date: August 16, 2023

Coswell listed on metaencryptor ransomware leak site

The Italian-based manufacturing company Coswell has been listed on the leak site associated with the metaencryptor ransomware group. According to the announcement made on August 16, 2023, the threat actor claims to have gained access to the company's networks, using the listing as a method to support this claim of unauthorized access.

Details of the claimed attack

The threat actor known as metaencryptor has published a listing on its dedicated leak site involving the organization Coswell. This action is part of a common ransomware tactic known as double extortion, where attackers not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information publicly to pressure the victim into paying a ransom. By listing the company on a public leak site, the group aims to increase visibility and pressure the target.

The directory structure shared by the group in the announcement suggests a level of access to the organization's internal files. However, the group has not provided specific details regarding the exact volume of data taken or the total number of files involved. The listing serves as a public claim of a successful breach and network infiltration.

Data involved in the listing

While the threat actor has shared a directory structure to demonstrate the nature of the breach, the specific content of the stolen data remains unclear. The shared directory structure includes the following elements:

• File lists
• A full dump
• Sample files

Beyond these structural elements, there is no detailed information regarding the specific content of the data contained within these files. No specific data types or individual records have been identified through the current announcement.

About Coswell

Coswell is an Italian family-run group of companies. The organization specializes in the manufacturing and distribution of a wide range of products, including body and oral care products, health foods, fragrances, skin care, and cosmetics. The company maintains a broad market presence, serving both the mass market and pharmacies.

Potential risks and industry implications

This incident may pose significant risks to the company's operational continuity and data privacy. Because Coswell is an Italy-based entity, the leaked data may fall under the scope of the European Union's General Data Protection Regulation (GDPR). The exposure of personal data belonging to employees or customers could potentially lead to identity theft and targeted phishing attacks.

Furthermore, as a company operating within the manufacturing sector, the disclosure of trade secrets or supply chain information may create secondary risks for the organization. In the manufacturing industry, protecting intellectual property and proprietary processes is critical to maintaining a competitive advantage.

To mitigate such risks, organizations in the manufacturing sector often implement defensive measures such as network segmentation, multi-factor authentication, and regular security awareness training for employees. Maintaining robust backup strategies and monitoring network traffic for unusual patterns are also common industry practices to defend against ransomware and unauthorized data exfiltration.

Information regarding the metaencryptor group remains limited at this time.