Dillon Supply listed on metaencryptor ransomware leak site

• Ransomware group: metaencryptor
• Country: United States
• Sector: Professional Services
• Announcement date: August 16, 2023

The metaencryptor ransomware group has listed Dillon Supply on its leak site, claiming a data breach has occurred. This development follows a pattern common in modern cyberattacks where threat actors use public platforms to pressure victims by threatening to release sensitive information.

The claimed attack event

On August 16, 2023, the metaencryptor group added Dillon Supply to its leak platform. The group claims to have successfully gained access to the organization's data. According to the announcement, the attackers have published a directory structure that includes various file lists and samples intended to demonstrate the scope of the breach.

Information regarding the metaencryptor group remains limited in the public domain, making it difficult to ascertain the full extent of their operations or their specific motivations. Ransomware leak sites like the one used by metaencryptor are typically utilized in double extortion schemes. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release, aiming to increase the likelihood of a ransom payment.

Details of the alleged data leak

The information provided by the threat actor suggests that the allegedly leaked data is organized into specific categories. Based on the available screenshots and directory structures provided by the group, the data is categorized into the following elements:

• File lists
• A full dump
• Samples

While the group has provided these categories and a directory structure, there is no detailed information regarding the specific nature or type of the leaked data. No specific information was provided regarding the total size of the data or the exact number of files involved in the incident.

About Dillon Supply

Dillon Supply is an organization engaged in the distribution of industrial products. Founded in 1914, the company has a long-standing presence in the industrial sector. Headquartered in Raleigh, North Carolina, the firm operates as a subsidiary of the European-based industrial supply giant Descours & Cabaud.

Potential risks and industry implications

The claim made by metaencryptor may pose significant risks to the organization's operational continuity and commercial reputation. Because the organization is based in the United States, the confirmation of a breach could trigger legal processes under state-level data breach notification laws and other relevant regulations.

As a company that distributes industrial products, the incident may create secondary risks for supply chain partners. Such breaches can facilitate targeted phishing attacks against the organization's business associates or employees. Furthermore, the publication of data may lead to risks such as identity theft for both employees and business partners.

In the professional services and industrial distribution sectors, organizations often implement defensive strategies to mitigate these risks. Common defensive steps include maintaining robust backup systems, implementing multi-factor authentication, and conducting regular security awareness training to prevent phishing. Organizations also focus on network segmentation and continuous monitoring to detect unauthorized access before data can be exfiltrated to leak sites.