Dunghill claims data breach against Ropertech.com and Vertafore.com

• Ransomware group: Dunghill
• Country: United States
• Sector: Technology
• Announcement date: September 26, 2023

Dunghill claims a massive data breach against Ropertech and Vertafore

The threat actor known as Dunghill has listed a significant amount of data, allegedly belonging to Ropertech and Vertafore, on its dedicated leak site. According to the claims made by the group, the stolen information totals approximately 2.2 TB in size. This announcement, which appeared on September 26, 2023, marks a significant potential breach for the involved entities.

Details of the alleged attack

On September 26, 2023, the Dunghill group published a listing on its leak platform targeting Ropertech and Vertafore. The threat actor claims to have successfully exfiltrated a total of 2.2 TB of data from these organizations. While the group has provided screenshots to support their claims, public information regarding the specific identity and background of the Dunghill group remains limited.

The group alleges that the stolen information is highly sensitive and encompasses various categories of organizational data. Based on the screenshots provided by the threat actor, the breach purportedly includes a wide range of files that could impact the operational and legal standing of the targeted companies.

The alleged stolen data includes:

• Corporate data
• Source codes
• Databases
• Client contracts
• Financial data
• HR information
• Emails

Beyond these specific categories, the group claims to have obtained marketing strategies, project files, IT infrastructure information, source codes such as AMS360 and Sagitta, confidential documents, business agreements, legal department documents, client documents, NDAs, accounting records, and various other sensitive files.

About Vertafore

Vertafore is an insurance technology company that develops content management, workflow software, data analytics, and knowledge base solutions for insurance companies. It provides software solutions that help participants in the insurance distribution channel scale their business processes and adapt to changes in the industry.

Potential impact and industry implications

If the data leak claimed by Dunghill is accurate, it could create significant operational risks for the affected organizations. The exposure of client contracts and financial data may lead to complex compliance issues under relevant industry regulations. Furthermore, the disclosure of source codes and IT infrastructure information may weaken the cybersecurity posture of the organizations, potentially facilitating secondary attacks by other threat actors.

The leak of HR data introduces additional risks, such as identity theft or targeted phishing attacks directed at employees. The group appears to be employing double extortion tactics, a method where attackers not only encrypt data but also threaten to leak it to increase pressure on the organization to pay the ransom. In such scenarios, organizations often face intense pressure to meet the attacker's demands to prevent the public release of sensitive information.

For organizations operating in the technology and insurance software sectors, maintaining robust security measures is critical. Common defensive steps include implementing strict access controls, conducting regular security audits, and ensuring comprehensive encryption for data at rest and in transit. Protecting source code and infrastructure details is particularly vital to prevent attackers from finding vulnerabilities for future exploitation. Additionally, companies must prepare for the regulatory and reputational fallout that follows a significant data exposure event.