Dispossessor ransomware group lists crtl.com on its leak site

• Ransomware group: Dispossessor
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: April 19, 2024

Dispossessor claims to have leaked data belonging to crtl.com

The ransomware group known as Dispossessor has listed crtl.com, also known as Crown Retail Services, on its dedicated leak site. According to the announcement made by the threat actor, the organization has been targeted in a cyberattack, and the group claims to have successfully exfiltrated data belonging to the entity. This development follows a pattern often seen in modern ransomware operations where groups use public leak sites to pressure victims by threatening to publish sensitive information.

Details of the claimed attack

The announcement regarding the compromise of crtl.com was posted on the Dispossessor leak site on April 19, 2024. While the announcement was made recently, the group alleges that the actual compromise of the institution occurred much earlier, specifically on November 8, 2022. This significant gap between the alleged intrusion and the public listing suggests a long-term presence within the network or a delay in the group's extortion process.

The group has indicated that they have obtained the institution's data and have expressed intentions to publish the information. In many ransomware scenarios, this involves a tactic known as double extortion, where attackers not only encrypt a victim's systems but also steal sensitive data to use as leverage during negotiations. By threatening to release the data publicly, the group aims to increase the pressure on the organization to meet their demands.

Information regarding the leaked data

At this stage, there is no information regarding the specific nature of the leaked or compromised data. The group has not provided details concerning the volume of the data or the specific types of files that were allegedly stolen. Furthermore, the provided documentation and screenshots associated with the listing do not contain specific details about the content of the files.

The listing names no specific data types or categories of information that have been compromised.

About Crown Retail Services

Crown Retail Services, operating under the domain crtl.com, is a real estate consulting firm. The company provides strategic retail leasing and tenant representation services across major cities throughout the United States and Canada. Through its extensive experience in the retail sector, the firm offers strategic solutions to its clients, focusing on the complexities of retail real estate and tenant management.

Risk assessment and industry implications

This incident may present a significant risk of exposure for the institution's operational data and customer information. Given that the organization is a US-based entity, the incident may trigger various legal obligations. Specifically, the institution may face data breach notification obligations under various state laws and federal regulations depending on the nature of the data and the residency of the affected individuals.

The potential exposure of data carries several secondary risks. If sensitive information is released, it could potentially be utilized for identity theft or targeted phishing attacks against the institution and its clients. Such attacks often use the stolen information to craft highly convincing messages to deceive employees or customers.

Regarding the threat actor, Dispossessor is a ransomware group that emerged in late 2023. The group has demonstrated a high level of technical capability, as they are alleged to have interfered with US law enforcement infrastructure in 2024. This history suggests that the group possesses significant technical resources and may be a sophisticated adversary.

For organizations operating in the retail and consulting sectors, such incidents highlight the necessity of robust security measures. Following an incident of this nature, organizations typically need to notify affected parties and conduct a thorough review of their security measures to prevent future occurrences. Maintaining comprehensive monitoring, implementing strict access controls, and ensuring regular updates to defensive systems are common industry practices to mitigate the impact of such sophisticated threats.