Dispossessor ransomware group lists www.empowerins.com on its leak site

• Ransomware group: Dispossessor
• Country: United States
• Sector: Financial Services
• Announcement date: April 19, 2024

Dispossessor claims data breach at Empower Insurance

The ransomware group known as Dispossessor has published a listing on its leak site claiming to have access to data belonging to Empower Insurance. This announcement, made on April 19, 2024, follows a timeline suggesting the initial compromise occurred much earlier. According to the group's claims, the data was originally uploaded on September 13, 2022, and was subsequently updated on December 26, 2023.

Ransomware attacks often involve a strategy known as double extortion, where threat actors not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive data. By threatening to release this information on a public leak site, the attackers aim to increase pressure on the victim to meet ransom demands. While the specific ransom demand and the total volume of stolen files remain unknown, the publication of such data serves as a tool for public shaming and further exploitation.

Details of the claimed exposure

The threat actor has shared specific details regarding the information they claim to have obtained from the institution. The post focuses on the internal operational processes of the organization by exposing the identities and contact details of its staff members. This type of exposure is particularly dangerous as it targets the human element within an organization's security perimeter.

The leaked information reportedly includes the following types of data:

• Employee names
• Employee job titles
• Employee phone numbers
• Employee email addresses

By releasing these specific identifiers, the group provides a roadmap for subsequent malicious activities. When personal details like job titles and direct contact information are made public, it becomes significantly easier for attackers to craft highly convincing social engineering campaigns.

About Empower Insurance

Empower Insurance is an insurance agency that operates within the state of Texas, United States. The company functions as an insurance brokerage, providing a variety of insurance solutions designed for both personal and commercial clients.

Security implications and industry risks

The exposure of employee contact information and job titles creates significant vulnerabilities for the affected institution and its staff. Primarily, this data can be used to facilitate identity theft, as attackers gain access to the specific professional identities of the employees. Furthermore, the availability of names, emails, and phone numbers makes the organization's workforce a prime target for spear-phishing attacks. These are highly targeted, sophisticated phishing attempts that use specific knowledge about a victim's role and contact details to trick them into revealing credentials or installing malware.

For an organization operating within the financial services sector, the consequences of such a leak extend beyond individual employee risk. The exposure of personal data can lead to a significant loss of customer trust and may trigger various regulatory compliance risks. Maintaining the confidentiality of internal and client-related information is a cornerstone of financial services, and any breach can compromise the perceived integrity of the institution's operations.

The Dispossessor group, which emerged in late 2023, has demonstrated a high level of capability, notably being linked to interference with US law enforcement infrastructure in August 2024. The publication of this data may facilitate secondary attacks and could compromise the overall operational security of the institution. To defend against such threats, organizations in this sector typically focus on implementing robust multi-factor authentication, conducting regular security awareness training to help employees recognize phishing attempts, and maintaining strict data minimization practices to limit the amount of sensitive information available if a breach occurs.