Daher Contracting targeted by Trigona ransomware group

• Ransomware group: Trigona
• Country: United States
• Sector: Professional Services
• Announcement date: January 31, 2024

The Trigona ransomware group has published an announcement on its leak site claiming to have compromised data belonging to Daher Contracting. The threat actor group listed the organization on its platform, asserting that they have obtained internal data from the company's systems.

The claims of the Trigona group

According to the announcement published on January 31, 2024, the Trigona group claims to have successfully infiltrated the network of Daher Contracting. The group alleges that the breach occurred on January 30, 2024. In conjunction with the claim of data exfiltration, the threat actors are demanding a ransom of 100,000 USD to prevent the release of the alleged stolen information.

Information regarding the Trigona group remains limited in the public domain, making it difficult to establish a comprehensive profile of their specific tactics, techniques, and procedures. Ransomware groups often utilize a "double extortion" model, where they not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak this data on a public leak site, the attackers aim to pressure the victim into paying the ransom to avoid reputational damage and regulatory consequences.

Data types involved in the alleged breach

The screenshots provided by the attackers suggest that the breach involves a variety of sensitive documents. The leaked information reportedly includes business-related documentation and highly sensitive personal identification files. The specific items identified in the listing include:

• Driver's licenses
• Identification cards
• Invoices
• Price quotations

The presence of such documents, particularly personal identification like Florida driver's licenses and identification cards, significantly increases the risk of identity theft and targeted phishing campaigns against the individuals involved. When attackers gain access to invoices and price quotations, they also gain insight into the company's commercial operations and financial relationships.

About Daher Contracting

Daher Contracting is an excavation and site development contractor serving the Okaloosa and Walton County areas. Operating since 1998, the company provides excavation and site preparation services for construction projects.

Impact and industry implications

The alleged breach may pose a significant risk to the privacy of employees and clients whose personal information appears to have been compromised. The exposure of identity documents and financial records creates a landscape where individuals may be vulnerable to fraud. Furthermore, the leakage of business-related documents could impact supply chain security and potentially damage the organization's professional reputation.

Given the company's location in the United States, this incident may trigger regulatory scrutiny under relevant state laws and federal data protection standards. Organizations operating in the professional services and construction sectors often handle a high volume of sensitive client data and subcontractor information, making them targets for such attacks.

To defend against these types of threats, organizations typically implement a multi-layered security strategy. This includes maintaining robust backup solutions that are isolated from the main network to ensure data can be restored without paying a ransom. Implementing multi-factor authentication (MFA) across all remote access points and sensitive applications is a critical step in preventing unauthorized entry. Furthermore, continuous monitoring of network traffic can help detect unusual patterns that might indicate data exfiltration. Regular security awareness training is also vital to help employees recognize phishing attempts, which are often the initial vector for ransomware deployment.