EirMed Devices, part of TRELLEBORG, targeted by ALPHV ransomware group

• Ransomware group: ALPHV
• Country: United States
• Sector: Manufacturing
• Announcement date: July 26, 2023

The ALPHV ransomware group has claimed responsibility for a significant data breach involving EirMed Devices, a company operating as part of the TRELLEBORG Group. According to an announcement made on a leak site on July 26, 2023, the threat actor group alleges that they have successfully exfiltrated 200 GB of data belonging to the organization. The group claims the initial compromise occurred around May 2, 2023.

The alleged attack and technical impact

The ALPHV ransomware group has provided specific details regarding the methods used during the alleged breach. The group claims to have compromised the network infrastructure of EirMed Devices and successfully disabled BitDefender antivirus software to facilitate their activities. This type of tactic, where security software is neutralized, is a common component of modern ransomware campaigns designed to evade detection during the lateral movement and data exfiltration phases.

Furthermore, the attackers claim to have caused significant disruption to the company's digital environment. Specifically, the group states that they have encrypted the organization's local backup storage and three ESXi servers. The encryption of backups is a particularly damaging tactic in ransomware attacks, as it aims to prevent the victim from restoring their systems through traditional recovery methods, thereby increasing the pressure to meet ransom demands.

While the group has not publicly stated a specific ransom demand, the nature of the announcement follows the pattern of double extortion. In such scenarios, threat actors not only encrypt a victim's data to disrupt operations but also steal sensitive information to use as leverage, threatening to leak it if the ransom is not paid. This dual-threat approach significantly increases the impact of a breach on both operational continuity and data privacy.

The scope of the alleged data leak

The information reportedly stolen by the ALPHV group is extensive, totaling 200 GB. The group claims that a dataset containing various sensitive internal documents and employee contact details has been published. The specific types of data mentioned as being part of the leak include:

• Employee contact details
• Internal company documents
• Manufacturing operation data
• Insurance certificates

The inclusion of manufacturing operation schedules and phone directories suggests that the breach may have access to both administrative and operational data, potentially exposing the inner workings of the company's production processes.

About EirMed Devices

EirMed Devices is a specialized entity within the TRELLEBORG Group. The company focuses on the design, engineering, manufacturing, assembly, and packaging of medical devices. Their primary mission involves creating medical solutions specifically designed to improve the lives of patients through advanced engineering and manufacturing processes.

Risk assessment and industry implications

This breach carries several significant risks for the organization and its stakeholders. For the employees of EirMed Devices, the exposure of contact details increases the risk of identity theft and makes them targets for highly specific, targeted phishing attacks. For the company itself, the disclosure of technical documents regarding manufacturing processes could potentially impact trade secrets, which are vital to maintaining a competitive advantage in the medical device sector.

There is also an assessment that other units within the larger TRELLEBORG Group may face similar risks following this incident. Additionally, given the highly regulated nature of the medical manufacturing sector, such a breach may lead to complications regarding compliance with relevant data protection regulations. Organizations in this sector must be particularly vigilant regarding the protection of both intellectual property and sensitive personal data to avoid regulatory scrutiny and operational disruption.

The ALPHV group, which emerged in late 2021, is known as a Ransomware-as-a-Service (RaaS) structure developed in the Rust programming language. Although the group announced the cessation of its activities as of March 2024, the historical impact of its campaigns remains highly significant in the cyber threat landscape.