El-Mohandes listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Egypt
• Sector: Agriculture and Food Production
• Announcement date: July 26, 2023

ALPHV claims a massive data breach at El-Mohandes

The ALPHV ransomware group has listed the Egyptian organization El-Mohandes on its dedicated leak site. According to the claims made by the threat actor, a significant volume of data has been compromised during a cyberattack targeting the company. The group alleges that the breach resulted in the theft of 1 TB of data, marking a major security incident for the organization.

Ransomware leak sites are platforms used by cybercriminal groups to exert pressure on victims. In many modern ransomware campaigns, threat actors employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data. If the victim refuses to pay the ransom to restore their systems, the attackers threaten to publish the stolen information on these public leak sites to cause maximum reputational and legal damage.

Details of the alleged attack

The ALPHV group, also known as BlackCat, claims that the attack against El-Mohandes occurred on February 5, 2023. The group's announcement regarding the breach was made on July 26, 2023. ALPHV is recognized as a Ransomware-as-a-Service (RaaS) provider. This business model allows developers to lease their sophisticated ransomware code to affiliates, who then carry out the actual attacks. The group's malware is notably written in the Rust programming language and first emerged in late 2021.

While the group's specific methods can vary, the use of high-level programming languages like Rust often indicates a focus on creating highly efficient and harder-to-detect malicious software. The timeline between the claimed attack date and the leak site announcement suggests a period of data exfiltration and negotiation or preparation for the leak.

Compromised data and sensitive information

The screenshots provided by the threat actor suggest that the stolen data contains highly sensitive documents. The information allegedly leaked includes various types of administrative and personal records that could be used for malicious purposes. The affected data types include:

• Financial records
• Bank account details
• Tax documents
• Personal identification information

The presence of such data—specifically bank statements, invoices, checks, tax authority documents, and personal identity card samples—presents a significant risk. When personal identification information and financial records are leaked, it often leads to secondary extortion attempts, where attackers may contact employees or customers directly, pretending to be authorities or company officials to solicit money.

Organizational profile of El-Mohandes

El-Mohandes is an established company operating in the agriculture and food production sector. Based in the El-Behira Governorate of Egypt, the organization was founded in 1998. The company provides a variety of industrial services, including filling, mixing, and blending, and also provides technical support for several different industries.

Risk assessment and implications

The alleged leak of this data carries heavy implications for El-Mohandes. The sensitive nature of the information, which includes financial operations and personal employee data, increases the risk of identity theft and targeted phishing attacks against both the company's staff and its customer base. Furthermore, the company may face legal liabilities under the data protection regulations established in Egypt.

From a business perspective, the publication of such data by the ALPHV group can cause lasting damage to the company's commercial reputation. For organizations in the agriculture and food production sector, maintaining the integrity of supply chain data and financial records is critical for operational continuity and trust. To defend against such threats, organizations typically implement multi-factor authentication, maintain offline backups, and conduct regular security awareness training to mitigate the risk of phishing and unauthorized access.