Crosswear.co.uk targeted by Madliberator in alleged data breach

• Ransomware group: Madliberator
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: July 17, 2024

Madliberator claims data breach at crosswear.co.uk

The threat actor known as Madliberator has published a claim on its leak site involving the United Kingdom-based organization crosswear.co.uk. According to the announcement made on July 17, 2024, the group has listed a series of files and directory structures that they claim belong to the company. This type of activity is common in modern ransomware campaigns, where threat actors often employ double extortion tactics. In these scenarios, attackers do not just encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information to use as leverage, threatening to leak it publicly if a ransom demand is not met.

The announcement suggests that various documents related to the organization's business operations are accessible via the group's leak site. While the specific details regarding the attack date were claimed to be June 19, 2024, the primary impact of the claim is the potential exposure of internal documentation. The group appears to be attempting to exert pressure on the organization by making these files available for public viewing.

Details of the claimed data exposure

Based on the information provided by the threat actor, the leaked directory contains a wide array of sensitive business and personal information. The screenshots associated with the claim display a file structure that indicates a deep penetration into the company's digital environment. The data identified in the listing includes various critical business assets that could be used to disrupt the company's commercial activities or target its stakeholders.

The specific categories of data claimed to be involved in this breach include:

• Accounting records
• Employee HR data
• Customer lists
• Order forms
• Inventory information

The presence of such diverse data types suggests that the attackers may have gained access to multiple internal systems, ranging from financial databases to human resources management tools and supply chain documentation.

About crosswear.co.uk

Crosswear is a company based in the United Kingdom operating within the professional services sector. The organization has a long-standing history in its industry, having been in operation since 1972. Crosswear provides specialized wholesale distribution services, specifically catering to the partyware and greeting card industries.

Impact and security considerations

The data claimed to be leaked could jeopardize the organization's operational continuity and commercial confidentiality. The exposure of sensitive information poses significant risks to the company's reputation and its relationship with partners and clients. Specifically, the exposure of customer and employee data may lead to legal sanctions under the UK GDPR, which is the data protection legislation in the United Kingdom.

Furthermore, the publication of financial and operational data could create a foundation for targeted phishing attacks against the organization's supply chain partners. When attackers possess detailed information about order forms, inventory, and accounting, they can craft highly convincing fraudulent communications to deceive vendors or customers. This secondary wave of attacks is a common consequence of data breaches in the distribution and wholesale sectors.

Information about the Madliberator group is limited in the public domain; therefore, the group's motivations and technical capabilities remain uncertain. For organizations facing similar threats, it is advisable to notify affected parties following a data breach and to conduct a thorough review of security measures. Strengthening defensive postures through regular audits, implementing multi-factor authentication, and maintaining robust backup strategies are standard industry practices to mitigate the impact of such incidents.