Creos Luxembourg targeted by ALPHV ransomware group

• Ransomware group: ALPHV
• Country: Luxembourg
• Sector: Energy & Utilities
• Announcement date: July 26, 2023

ALPHV claims data breach at Creos Luxembourg

The ALPHV ransomware group, also known as BlackCat, has listed the Luxembourg-based energy provider Creos Luxembourg on its leak site. According to the group's announcement, the breach involves a significant volume of stolen information, with the group claiming to have compromised over 150 GB of data. The leak site announcement, posted on July 26, 2023, suggests that the initial compromise may have occurred much earlier, with the group claiming the attack took place on July 29, 2022.

The group asserts that the stolen information is linked to the operational activities of the organization. This type of incident is characteristic of modern ransomware operations, where threat actors move beyond simple encryption to a method known as double extortion. In such scenarios, attackers not only lock an organization's systems but also steal sensitive data to use as leverage, threatening to release it publicly unless a ransom is paid. This tactic places immense pressure on companies due to the potential for regulatory scrutiny and reputational damage.

Details of the alleged data theft

The ALPHV group claims to have obtained a vast array of documents through this breach. The volume of the data is substantial, with the group alleging that more than 180,000 files were exfiltrated. The leaked content is said to include various types of sensitive corporate and personal information that could be used for malicious purposes. According to the group's claims, the stolen data includes:

• Contracts
• Agreements
• Passports
• Bills
• Emails
• Financial data
• Identity information

To support their claims, the group has provided screenshots that purportedly show samples of the stolen information. These samples reportedly include financial statements and various identity documents, which reinforces the group's claim that they have access to sensitive personal and corporate records.

About Creos Luxembourg

Creos Luxembourg S.A. is a vital entity within the Grand Duchy of Luxembourg, serving as the owner and manager of the nation's electricity networks and natural gas pipelines. The company's responsibilities are broad and essential to the region's infrastructure, encompassing the planning, construction, and maintenance of high, medium, and low-voltage electricity networks. Additionally, the organization manages high, medium, and low-pressure natural gas pipelines, making it a cornerstone of the local energy and utility sector.

Risks and implications for critical infrastructure

This incident highlights the significant risks faced by entities operating within the critical infrastructure sector. When organizations responsible for essential services like energy and utilities are targeted, the implications extend beyond simple data loss. Such breaches can pose risks to the operational continuity and overall data security of the entity. Furthermore, the presence of highly sensitive documents, such as passports and financial records, in the hands of threat actors creates a high risk of identity theft for the individuals whose information was compromised.

Because Creos Luxembourg is based in Luxembourg, this incident may be subject to rigorous data protection assessments under the General Data Protection Regulation (GDPR), which governs how personal data is handled and protected within the European Union. The exposure of identity documents and financial information often triggers strict reporting requirements to ensure transparency and protect the rights of the affected parties.

The ALPHV group is known for using sophisticated, Rust-based malware to carry out their operations. For organizations in the energy and utility sector, maintaining vigilance is paramount. To mitigate the risks associated with such targeted attacks, organizations often need to implement robust defensive measures and remain alert to the possibility of follow-on threats, such as targeted phishing attacks that exploit the leaked information. In the event of a confirmed breach, notifying the affected parties is a critical step in managing the fallout and helping individuals protect themselves from potential identity fraud.