Donex ransomware group lists elsapspa on its leak site

• Ransomware group: Donex
• Country: Italy
• Sector: Technology
• Announcement date: March 8, 2024

The Donex ransomware group has published an announcement on its leak site claiming to have exfiltrated 49 GB of data belonging to Elsap, an Italian technology company. The threat actor's post, announced on March 8, 2024, alleges that the initial compromise occurred around February 24, 2024.

Details of the alleged attack

The threat actor known as Donex has created a leak announcement claiming to have compromised data belonging to Elsap. The post includes general information regarding the company's operations and alleges that a significant volume of data has been stolen. While the group has made these claims, information regarding the specific identity and technical operations of this group remains limited in the public domain.

Ransomware groups often utilize leak sites to host announcements following a successful intrusion. These sites serve as a platform for the attackers to claim responsibility and pressure the victim. In many modern cyberattacks, threat actors employ a tactic known as double extortion. This method involves not only encrypting a victim's systems to disrupt operations but also stealing sensitive information beforehand. By threatening to release this stolen data publicly, the attackers aim to increase the pressure on the organization to meet their demands.

Content of the alleged leaked data

The content of the alleged leaked data is not fully specified by the threat actor. However, based on available screenshots, technical documents and assembly diagrams are visible. While the specific scope of the stolen files has not been entirely detailed, the presence of these technical materials suggests the potential sensitivity of the information.

Affected data types

• Technical documents
• Assembly diagrams

The listing does not specify the exact nature of all files, and no specific ransom demand has been mentioned in the announcement.

About Elsap

Elsap is an Italian company that has been dedicated to the representation and distribution of electronic and electromechanical components for over 50 years. Operating within the technology sector, the company maintains a long-standing presence in its industry.

Potential impact and risks

Depending on the nature of the leaked data, risks to the company's trade secrets or technical projects may arise. Because the organization is based in Italy, potential data protection violations under the General Data Protection Regulation (GDPR) may be subject to review. Furthermore, the public release of data can lead to significant reputational damage for the organization.

The breach also poses secondary risks to external parties. Customers and business partners of the company may remain vulnerable to potential identity theft or targeted phishing attacks if their information is included in the exfiltrated datasets. Attackers often use stolen corporate data to launch highly convincing social engineering campaigns against a company's supply chain.

To mitigate such risks, organizations in the technology and component distribution sectors often implement various defensive measures. These include robust encryption for data at rest and in transit, strict access controls to prevent unauthorized exfiltration, and continuous monitoring of network traffic for unusual patterns. Additionally, maintaining a comprehensive incident response plan and conducting regular security awareness training for employees are standard practices to defend against the evolving tactics used by ransomware groups.