Epiq Global (MSP) listed on Ryuk ransomware leak site

• Ransomware group: Ryuk
• Country: United States
• Sector: Technology
• Announcement date: February 29, 2020

Ryuk ransomware group claims data breach at Epiq Global (MSP)

The Ryuk ransomware group has made a data leak claim regarding Epiq Global (MSP). On February 29, 2020, the group listed the organization on their dedicated leak site, claiming to have gained access to the organization's data. This announcement marks a significant development in the ongoing activity of the Ryuk threat actor group.

Details of the claimed attack

According to the announcement made on February 29, 2020, the Ryuk group claims to have successfully breached the perimeter of Epiq Global (MSP). While the group has publicly listed the organization, information regarding this specific threat actor group remains limited in the public domain. Ransomware leak sites are often used by cybercriminals as a platform for double extortion, a tactic where attackers not only encrypt an organization's data but also threaten to release sensitive information to the public unless a ransom is paid. This method increases the pressure on victims by threatening their reputation and legal standing.

Information regarding the leaked data

At this time, there is no information regarding the nature of the leaked or threatened data. The group has not provided any screenshots to substantiate the claim or to demonstrate the contents of the alleged breach. Consequently, the specific types of files or the volume of data involved remain unknown.

Because the listing does not specify the contents, the exact scope of the data compromise cannot be determined from the available information.

Organization profile

Epiq Global (MSP) is an organization operating within the technology sector. As a Managed Service Provider (MSP), the organization plays a critical role in providing technical services and infrastructure management to other entities.

Potential impact and industry risks

This claim may lead to operational disruptions and reputational damage for the organization. If a data breach has occurred, it may trigger notification obligations under US state laws and federal regulations. Beyond the immediate technical impact, secondary risks may include the potential use of leaked data in identity theft or targeted phishing attacks against the organization or its stakeholders.

Because the organization is an MSP, the risks regarding supply chain attacks may be elevated. In a supply chain attack, a threat actor targets a service provider to gain indirect access to the provider's clients. This can result in a cascading effect where the compromise of a single provider leads to widespread impact across multiple downstream organizations. For organizations in the technology and managed services sector, maintaining robust security postures is essential to mitigate these risks.

Defensive considerations for the sector

To defend against such threats, organizations often implement various security measures. Common defensive steps include maintaining rigorous patch management schedules, implementing multi-factor authentication (MFA) across all access points, and conducting regular vulnerability assessments. Furthermore, because MSPs are high-value targets, implementing strict principle of least privilege (PoLP) access controls and continuous monitoring of network traffic can help detect unauthorized access attempts before they escalate into full-scale breaches.