Don’t Waste Group listed on Inc Ransom leak site following claims of a data breach

• Ransomware group: Inc Ransom
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: August 22, 2024

Don’t Waste Group has been listed on the leak site of the Inc Ransom ransomware group, following allegations of a data breach. The announcement, made on August 22, 2024, suggests that the organization has been targeted in a cyberattack aimed at compromising its operational processes.

The details of the claim

On August 22, 2024, the Inc Ransom group published a listing for Don’t Waste Group on their dedicated leak site. This announcement serves as a claim of a successful breach against the organization. To support their claims, the threat actors shared various documents as alleged evidence of the breach. The nature of the incident, as described by the group, involves an attack that targets the organization's operational processes.

Ransomware groups often use leak sites to pressure victims into paying ransoms. These sites serve as a public platform where attackers post information about their targets. When a group lists an organization, it is often a signal that negotiations have failed or that the group is moving toward the next phase of their extortion campaign. In this instance, the group has moved to publicize the incident by listing the company on their platform.

Data involved in the incident

The group has provided certain materials to support their claims of a breach. Based on the available information, the screenshot provided by the attackers displays various document samples that appear to be related to the organization's business processes. However, there is no detailed information regarding the full scope or the specific nature of the leaked data.

The listing does not provide specific details regarding the volume of data or the exact types of files that may have been compromised. The following observations can be made regarding the current state of the information:

• The listing names no specific data types.

About Don’t Waste Group

Don’t Waste Group is a company that provides business intelligence, site management, and waste management services to the property, retail, commercial, industrial, and hospitality sectors. Operating for over twenty-five years, the firm serves the world's leading property management groups. The organization plays a role in managing essential services for various large-scale commercial and industrial sectors.

Implications and risks

Considering the double-extortion tactics of the Inc Ransom group, the sensitive data of the organization may have been leaked or encrypted. Double extortion is a common ransomware strategy where attackers not only encrypt the victim's files to disrupt operations but also steal sensitive information to threaten its public release. This method increases the pressure on the victim to comply with ransom demands.

As the organization is based in the United Kingdom, the incident may trigger data protection obligations under the UK GDPR. Such incidents often require organizations to assess their regulatory compliance and report breaches to the relevant authorities if personal data is involved. Furthermore, secondary risks may arise for the organization's employees and customers, such as identity theft or targeted phishing attacks. Threat actors often use stolen information to conduct more sophisticated social engineering campaigns against individuals associated with the breached company.

The group's past activities indicate a tendency to infiltrate corporate networks and publish data, which can create negative impacts on the organization's commercial reputation. For organizations in the professional services sector, maintaining robust security postures is critical. This includes implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of infiltration and data exfiltration.