Erbilbil Bilgisayar listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Türkiye
• Sector: Technology
• Announcement date: January 8, 2024

The ALPHV ransomware group has listed Erbilbil Bilgisayar on its dedicated leak site. According to the group's announcement, the organization has been targeted in a data breach, with the threat actors claiming to have obtained sensitive information related to the company and its business operations.

The claims made by ALPHV

The ALPHV group alleges that they have successfully gained access to data belonging to Erbilbil Bilgisayar. A significant aspect of this claim involves the scope of the breach; the group asserts that they have accessed the data of various third-party companies through the software services provided by the firm. This suggests that the breach may extend beyond the direct infrastructure of the target organization to its client base.

In accordance with the group's typical operational procedures, a deadline has been established. The attackers have set a 48-hour window, threatening to release the full dataset if their specific demands are not met within this timeframe. While the group has made these claims, no specific ransom demand has been disclosed in the public announcement.

Data involved in the alleged breach

The information released by the group includes visual evidence of the stolen data. Screenshots provided by the attackers contain numerous images that appear to represent sensitive documentation. The types of data identified in the leak include:

• Identity information
• Tax documents
• Commercial records

The presence of these documents, which include images of Republic of Turkey identity cards and tax registration documents, indicates that the breach involves highly sensitive personal and corporate information.

About Erbilbil Bilgisayar

Erbilbil Bilgisayar is an IT company based in Istanbul. The company provides software solutions and technological services to its clients.

Analysis and implications for the sector

The nature of this incident highlights significant risks regarding supply chain security. Because the group claims to have accessed data belonging to third-party clients via the software services provided by Erbilbil Bilgisayar, the breach poses a potential risk to the entire ecosystem of the company's partners. When a service provider is compromised, the downstream impact on clients can be substantial, potentially leading to secondary risks such as identity theft and fraud for the individuals whose information has been exposed.

The ALPHV group, also known as BlackCat, is a sophisticated ransomware entity known for utilizing Rust-based malware. The group is recognized for employing double-extortion tactics, a method where attackers not only encrypt an organization's data but also steal it, threatening to leak the information publicly to increase pressure for payment. This tactic significantly increases the stakes for organizations, as the threat of data exposure remains even if systems are restored from backups.

Given that the organization operates in Turkey, the incident may necessitate compliance with KVKK data breach notification requirements. For organizations operating in the technology and software services sector, such incidents underscore the importance of robust security measures to protect client data. Organizations and their clients may need to remain highly vigilant against targeted phishing attacks, as the leaked information can be used by threat actors to craft convincing social engineering campaigns. Maintaining proactive monitoring and strict access controls is a fundamental defensive step in mitigating the impact of such potential supply chain vulnerabilities.