donutleaks ransomware group lists Sidockgroup. Published on its leak site

• Ransomware group: donutleaks
• Country: United States
• Announcement date: November 10, 2023

Sidockgroup listed on donutleaks leak site

The donutleaks ransomware group has published a listing on its leak site claiming to have stolen data belonging to Sidockgroup, a Michigan-based firm. According to the threat actor, the publication of this data is a direct consequence of the institution's stance during the negotiation process. The group has indicated that they are currently releasing only a portion of the stolen information, but they have threatened to distribute the remaining data if the institution fails to meet their demands.

Details of the claimed data breach

The announcement made by the donutleaks group suggests that the stolen information is highly sensitive and contains various types of personal and corporate data. The threat actor claims that the datasets include critical identifiers and financial documents. Based on the screenshots provided in the leak announcement, the following types of information are allegedly involved:

• Credit card information
• Bills
• Social Security Numbers (SSN)
• Project reports
• Health enrollment information
• Payment records

The presence of such diverse data types, ranging from financial records to health-related information and corporate project reports, highlights the potential scope of the breach. The group's tactic of releasing data in stages is a common feature of double extortion ransomware attacks. In these scenarios, attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage, threatening to leak it publicly unless a ransom is paid.

About Sidockgroup

Sidock Group is a full-service architecture and engineering firm that was established in 1974. The company maintains multiple offices throughout the state of Michigan and provides a wide range of design and engineering services across various market sectors.

Potential risks and implications

This leak suggests that both employees and clients of Sidockgroup may be exposed to significant risks, including identity theft and financial fraud, due to the nature of the claimed stolen data. Because the institution is based in the United States, the exposure of such sensitive information may lead to legal repercussions under HIPAA or other relevant state laws. Consequently, the institution may be required to fulfill specific data breach notification obligations and inform all affected parties regarding the compromise of their information.

Furthermore, there is a possibility that the leaked data could be utilized by malicious actors in secondary attacks or targeted phishing campaigns. When sensitive details like Social Security Numbers and payment records are leaked, they become valuable assets for criminals looking to conduct highly convincing social engineering attacks against individuals or the organization itself.

In general, when organizations face such threats, defensive measures often include implementing robust multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized access. For organizations in the architecture and engineering sector, protecting project reports and client financial data is critical to maintaining professional trust and regulatory compliance. It is important to note that information regarding the donutleaks group remains limited.