DoppelPaymer claims data breach at 4 Canadian courier divisions of TFI International's Canpar Express

• Ransomware group: DoppelPaymer
• Country: Canada
• Sector: Transportation
• Announcement date: August 19, 2020

DoppelPaymer claims a data breach against TFI International's Canpar Express divisions

The threat actor known as DoppelPaymer has announced a data breach involving four Canadian courier divisions of TFI International's Canpar Express. In a post dated August 19, 2020, the group claimed to have targeted the organization, asserting that they successfully gained access to the organization's networks and exfiltrated sensitive data.

Details of the alleged attack

According to the announcement made on the group's leak site, the attack was claimed to have occurred on August 19, 2020. The threat actor, identified as DoppelPaymer, has made public claims regarding their ability to penetrate the organization's digital infrastructure. While the group has made these assertions, information regarding this specific group remains limited in the public domain.

Ransomware attacks often involve a tactic known as double extortion. In such scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. This method increases the pressure on an organization, as the threat of public exposure can lead to significant reputational and legal consequences.

Data involved in the claim

The listing names no specific data types or detailed information regarding the nature of the leaked data. No screenshots or specific details concerning the content of the alleged exfiltration have been provided by the threat actor.

The target organization

The organization targeted in this claim consists of four Canadian courier divisions of TFI International's Canpar Express. These divisions operate within the transportation sector, a critical component of global and local supply chains.

Potential impact and organizational risks

The claims made by DoppelPaymer could lead to significant operational disruptions and reputational damage for the organization. Because the target operates within Canada, the organization may face specific legal obligations regarding the protection of personal data under the PIPEDA regulations. Such regulatory frameworks are designed to ensure that organizations maintain high standards of data privacy and accountability.

Depending on the nature of the alleged leaked data, several secondary risks may arise for the organization's stakeholders. For employees or customers, the exposure of sensitive information could lead to risks such as identity theft and targeted phishing campaigns. Furthermore, such leaks can have a broader impact on supply chain security and may result in a loss of trust among the organization's business partners.

To defend against such threats, organizations in the transportation and logistics sectors often implement various defensive measures. These include robust network segmentation to prevent lateral movement by attackers, continuous monitoring of network traffic to detect unauthorized access, and comprehensive encryption protocols for data at rest and in transit. Additionally, maintaining a strong incident response plan and conducting regular security awareness training for employees are standard practices to mitigate the impact of potential breaches and reduce the likelihood of successful phishing attempts.