Emtelco listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Colombia
• Sector: Professional Services
• Announcement date: May 5, 2023

The Colombia-based professional services company Emtelco has been listed on the leak site of the Qilin ransomware group. The threat actor group claims to have gained access to sensitive information belonging to the organization, marking a significant development in the ongoing landscape of cyber extortion.

The alleged attack and claims by Qilin

The Qilin ransomware group has listed data on its leak site that it claims belongs to Emtelco. According to the group's announcement, they possess sensitive information belonging to the company's corporate clients as well as various non-disclosure agreements. To support these claims, the group has provided samples of the allegedly exfiltrated data as part of their public announcement on the leak site.

Ransomware leak sites are platforms used by cybercriminal groups to host information stolen from victims during a breach. These sites serve as a tool for public pressure, often used in what is known as double extortion. In a double extortion scheme, attackers do not just encrypt a victim's systems to demand a ransom for decryption; they also steal sensitive data and threaten to publish it online unless the ransom is paid. This tactic is designed to maximize leverage by threatening the victim's reputation and legal standing.

Data involved in the alleged breach

The information allegedly stolen by the Qilin group includes various types of sensitive corporate documentation. Based on the claims made by the threat actor, the affected data types include:

• Corporate client data
• Non-disclosure agreements

The presence of such documents on a leak site suggests that the attackers are targeting the core business relationships and legal frameworks of the organization.

About Emtelco

Emtelco is a Colombia-based outsourcing and customer experience management company. The company provides call center, digital transformation, and business process management services to clients across various industries.

Analysis and potential impact

This leak may pose secondary risks to Emtelco's clients and could lead to a loss of corporate reputation. Because the group employs double extortion tactics, they aim to exert pressure through the threat of publishing data. Furthermore, there is a possibility that the leaked data could be used in targeted phishing attacks, where attackers use stolen information to craft highly convincing fraudulent communications to deceive individuals or other organizations.

From a legal perspective, the company may face legal proceedings under Colombian data protection regulations due to the potential exposure of client information. The impact of such a breach often extends beyond the immediate organization to include the entire supply chain of the affected company.

In the professional services sector, organizations often handle vast amounts of sensitive third-party information, making them high-value targets for ransomware groups. To mitigate such risks, organizations typically focus on robust defensive measures. These include implementing strict access controls, maintaining regular offline backups, and conducting comprehensive employee training to recognize phishing attempts. Additionally, monitoring for unauthorized data exfiltration and maintaining a strong incident response plan are critical components of a modern cybersecurity posture. Public information regarding the Qilin group remains limited, making it difficult to determine the full scope of their operations or specific technical methodologies.