DMCI Holding data allegedly leaked by Ragnar Locker

• Ransomware group: Ragnar Locker
• Country: Philippines
• Announcement date: October 10, 2022

Ragnar Locker claims to have leaked DMCI Holding data

The ransomware group known as Ragnar Locker has listed a significant amount of data on its leak site, which they claim belongs to the Philippine-based organization DMCI Holding. According to the announcement made on October 10, 2022, the group claims to have exfiltrated a total of 308 GB of data from the company's systems.

The group's claim involves a specific method of operation often seen in modern cyberattacks, where data is stolen before the actual encryption process begins. This technique, frequently associated with double extortion tactics, allows threat actors to pressure victims by threatening to release sensitive information publicly if demands are not met. In this instance, the group has already proceeded to publish a listing of the stolen information.

The claims made by Ragnar Locker

In their announcement, Ragnar Locker claims that DMCI Holding failed to adequately address existing security vulnerabilities within its infrastructure. The group asserts that this failure directly led to the unauthorized access and subsequent publication of the company's data on their dedicated leak site. The announcement was officially published on October 10, 2022, the same date the group claims the attack occurred.

The group has not provided information regarding a specific ransom demand. While the size of the data breach is claimed to be 308 GB, the specific number of files included in this volume has not been disclosed by the attackers. The listing serves as a public notification of the alleged breach, aimed at increasing pressure on the victim organization.

Details of the alleged data breach

The information released by the group includes a wide variety of sensitive documents and records. Based on screenshots provided by the attackers, the leaked content appears to encompass a broad spectrum of corporate and personal information. The data allegedly includes:

• Customer personal data
• Employee information
• Financial records
• Identity documents
• Injury investigation reports

Specifically, the content mentioned in the screenshots includes budget spreadsheets, customer registration forms, payment documents, email correspondence, SMS notifications, tax documents, employee information, ID cards, injury investigation reports, and passport scans. The breadth of this data suggests a deep penetration into various administrative and operational departments of the organization.

About DMCI Holding

DMCI Holdings is a major Philippine-based holding company with diverse operations in construction, energy, mining, and real estate. The company holds a significant market share in infrastructure projects and natural resource management. Due to its presence in these critical sectors, the organization plays a vital role in the economic landscape of the Philippines.

Potential impact and industry implications

The alleged leak of such a diverse set of data poses significant risks. For the employees and customers of DMCI Holding, the exposure of identity documents, passport scans, and personal information significantly increases the risk of identity theft and fraud. Furthermore, the nature of the shared data suggests that the organization may face legal liabilities under Philippine data privacy regulations.

From an operational standpoint, the method used by Ragnar Locker—exfiltrating data before encryption—can jeopardize a company's operational continuity. Such a breach can lead to substantial reputational damage and may potentially make the organization a target for subsequent supply chain attacks, where attackers leverage the compromised data to target the company's partners or clients. While information regarding the specific capabilities and history of the Ragnar Locker group remains limited, the impact of their actions can be widespread.

For organizations operating in critical sectors like construction, energy, and mining, these types of incidents highlight the importance of robust security posture. Defensive measures typically include implementing multi-factor authentication, maintaining rigorous patch management to address vulnerabilities, and ensuring comprehensive data encryption both at rest and in transit. Additionally, organizations often focus on monitoring for unauthorized data exfiltration to detect such breaches before they escalate to a public leak.