Crownlea Group listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: July 29, 2024

The Hunters ransomware group has listed the United Kingdom-based professional services firm Crownlea Group on its dedicated leak site. According to the group's announcement, which was made on July 29, 2024, the attackers claim to have successfully exfiltrated a significant volume of data from the organization's networks.

Details of the alleged attack

The Hunters group alleges that they gained unauthorized access to the networks belonging to Crownlea Group and subsequently conducted a data breach. According to the group's claims, the incident was officially announced at the end of July 2024. The threat actors have stated that the management of Crownlea Group has refused to engage in negotiations regarding the incident.

As a result of this refusal to negotiate, the ransomware group has threatened to publish the allegedly exfiltrated data in its entirety on their leak site. This tactic is a common component of double extortion ransomware campaigns, where attackers not only encrypt an organization's systems but also steal sensitive information to use as leverage for extortion. By threatening to release the data publicly, the attackers aim to increase the pressure on the victim organization to meet their demands.

The allegedly exfiltrated data

The information provided by the attackers suggests a massive breach involving a substantial amount of sensitive information. The group claims that the stolen dataset consists of approximately 415.3 GB of data, which is comprised of 360,535 individual files. The presence of such a large volume of files indicates a deep penetration into the target's digital infrastructure.

The post specifically mentions that the stolen data includes highly sensitive personal identification documents. The types of data allegedly compromised include:

• Passports
• Driver's licenses

The inclusion of such identity documents significantly increases the potential impact of the breach, as these items are primary targets for fraudulent activities.

About Crownlea Group

Crownlea Group is a professional services company based in the United Kingdom. The company provides various business solutions and consultancy services to its clients, operating within the professional services sector.

Impact and security implications

The alleged theft of sensitive documents, such as passports and driver's licenses, poses a high risk of identity theft for the employees and customers associated with Crownlea Group. When personal identification documents are leaked, they can be exploited by malicious actors for various fraudulent purposes, including opening unauthorized accounts or committing financial crimes.

Because Crownlea Group is based in the United Kingdom, this incident is likely to be subject to scrutiny by data protection authorities under the UK GDPR framework. Regulatory bodies often investigate such incidents to ensure that organizations are maintaining adequate security measures to protect personal data. Furthermore, given the historical activities of the Hunters group, there is a possibility that the leaked data could be used in secondary attacks or targeted phishing campaigns against the affected individuals.

The refusal to negotiate, while a strategic choice for the organization, may lead to the full disclosure of the data on the leak site, which could result in significant reputational damage for the company. For organizations in the professional services sector, maintaining robust cybersecurity defenses is critical. Common defensive steps include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training to mitigate the risk of initial access through phishing or other common vectors. Additionally, monitoring for unauthorized data exfiltration and maintaining offline backups can help organizations respond more effectively to ransomware incidents.