Dalumi Group listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Israel
• Sector: Retail & E-Commerce
• Announcement date: July 26, 2023

ALPHV claims data breach at Dalumi Group

The ALPHV ransomware group has listed Dalumi Group on its dedicated leak site, claiming to have obtained data belonging to the organization. This announcement, which appeared on the group's platform, suggests a significant security incident involving the international diamond company.

The incident was officially announced on the leak site on July 26, 2023. However, the group claims that the actual attack or the initial access to the organization's digital assets occurred much earlier, specifically on April 4, 2023. This discrepancy between the date of the breach and the public disclosure is a common occurrence in ransomware extortion campaigns, where threat actors may hold data for an extended period before making it public to increase pressure on the victim.

Details of the alleged claim

The ALPHV group, also known as BlackCat, is the entity responsible for the listing. In their announcement, the group alleges that they have successfully gained access to the digital assets of Dalumi Group. The disclosure was not merely a name on a list; it was accompanied by a descriptive text providing context regarding the company's operations and its historical background within the industry.

Despite the presence of this descriptive text, the group has not provided specific details regarding the breach itself. Specifically, there is no information or file sample provided regarding the nature of the data allegedly leaked. The listing does not specify the volume of data taken or the specific types of files that were accessed during the intrusion. Furthermore, the group has not issued a ransom demand or provided details regarding the total file count involved in the incident.

About Dalumi Group

Dalumi Group is an international diamond manufacturing and trading company. The organization has maintained a significant position in the industry as a De Beers Sightholder since 1993. The company specializes in the sourcing of rough diamonds and the distribution of polished diamonds, operating within the retail and e-commerce sectors.

Impact and risks of the disclosure

This announcement by the ALPHV group may pose risks to the organization's operational continuity. Although the content of the allegedly leaked data remains unclear, the disclosure of corporate information could lead to a loss of commercial reputation and negative impacts on the supply chain. In the diamond trade, where trust and provenance are paramount, such disclosures can be particularly damaging to business relationships.

ALPHV is a Ransomware-as-a-Service (RaaS) group that emerged in late 2021. The group is known for utilizing malware developed in the Rust language, a programming language often chosen by sophisticated developers for its performance and memory safety features. Because of the nature of RaaS operations, it is possible that sensitive data could be sold to third parties or used in secondary attacks, such as phishing or social engineering campaigns targeting the company's partners or clients.

It is important to note that while it has been reported that the ALPHV group ceased operations as of 2024, the effects of previously leaked data may persist for years. Once data is published on a leak site, it becomes part of the public domain for malicious actors to exploit, regardless of whether the original ransomware group is still active.

Defensive considerations for the sector

For organizations operating in the retail and e-commerce sectors, particularly those involved in high-value commodity trading, several defensive steps are critical to mitigate the risks posed by RaaS groups:

• Robust access controls: Implementing strict identity and access management to ensure that only authorized personnel can access sensitive digital assets.
• Network segmentation: Dividing networks into smaller segments to prevent lateral movement by attackers once they have gained initial access.
• Continuous monitoring: Maintaining visibility over network traffic and system logs to detect unauthorized access or unusual data movement early in the attack lifecycle.
• Supply chain security: Recognizing that a breach in one organization can impact the entire supply chain, making it essential to vet the cybersecurity posture of all business partners.