Dollmar SpA data leaked by Ragnar Locker

• Ransomware group: Ragnar Locker
• Country: Italy
• Sector: Manufacturing
• Announcement date: October 19, 2022

Ragnar Locker claims to have leaked Dollmar SpA data

The Ragnar Locker ransomware group has announced the leak of data allegedly belonging to Dollmar SpA, an industrial company based in Italy. According to the announcement made on the group's leak site on October 19, 2022, the breach involves a significant volume of sensitive information. The group claims that the organization failed to adequately address existing security vulnerabilities, a failure that they assert directly led to the public release of the stolen data.

This incident follows a pattern often seen in modern cyberattacks where threat actors use public platforms to pressure victims. By publishing samples of corporate and personal information, the group aims to demonstrate the validity of their claims and increase the pressure on the target organization. The announcement of this breach occurred on the same day it was allegedly claimed to have taken place.

Details of the alleged data breach

The Ragnar Locker group claims to have published approximately 35.4 GB of data on its dedicated leak site. The contents of this alleged leak are extensive, spanning various categories of sensitive corporate and personal documentation. The group has provided various document samples to support their claims of having successfully exfiltrated the data.

The information allegedly included in the leak consists of the following types of data:

• Commercial contracts
• Financial statements
• Customer data
• Employee personal data
• Supplier information
• Passport scans

The presence of such diverse data types, ranging from high-level financial documents to highly sensitive personal identification like passport scans, suggests a broad compromise of the organization's digital environment. The inclusion of email communications, confidential correspondence, and budget reports indicates that the breach may have touched upon both administrative and operational layers of the company.

About Dollmar SpA

Dollmar SpA is an Italian company that operates within the manufacturing sector. The organization specializes in the production and distribution of chemical products, as well as industrial cleaning and surface treatment solutions. Their service offerings are designed to provide specialized solutions for several critical industries, including the automotive sector, the mechanical sector, and various other general industrial sectors.

Potential impact and security implications

This breach presents several significant risks to Dollmar SpA, its employees, and its business partners. The exposure of personal information, specifically passport scans and contact details, creates a heightened risk of identity theft and targeted phishing attacks. When personal data is leaked, attackers can use it to craft highly convincing social engineering campaigns aimed at individuals within the organization or their external partners.

Furthermore, the exposure of commercial and financial data, such as joint venture agreements, client orders, and budget reports, could potentially weaken the company's competitive advantage. The loss of confidential business information can also damage the trust established with third parties and business partners. From a regulatory perspective, the company may be required to fulfill specific data breach notification obligations under the General Data Protection Regulation (GDPR) applicable in Italy.

The Ragnar Locker group is known for employing a double-extortion strategy. This method involves encrypting the victim's data to disrupt operations and simultaneously stealing the data to threaten its public release if a ransom is not paid. While international law enforcement operations have previously restricted the activities of the Ragnar Locker group, the secondary risks associated with this specific leak may persist for a long time. Organizations in the manufacturing sector can mitigate such risks by implementing robust security measures, such as regular vulnerability assessments, multi-factor authentication, and comprehensive data encryption, to protect against the evolving tactics of ransomware groups.