FALCO Electronics targeted by Trigona ransomware group

• Ransomware group: Trigona
• Country: Mexico
• Sector: Technology
• Announcement date: February 14, 2024

Trigona ransomware group claims data breach at FALCO Electronics

The technology company FALCO Electronics has allegedly been targeted by the Trigona ransomware group. According to an announcement made on a ransomware leak site on February 14, 2024, the threat actor claims to have successfully exfiltrated internal data belonging to the organization. This incident follows an alleged attack date of January 30, 2024.

The Trigona group has listed the company on its leak site as part of a data breach notification. In such scenarios, ransomware groups often employ a tactic known as double extortion. This method involves not only encrypting an organization's local systems to disrupt operations but also stealing sensitive information to use as leverage. By threatening to release stolen data publicly, attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or confidential information.

Details of the alleged extortion attempt

The threat actor, identified as Trigona, has posted various document samples to support their claims of possessing internal company information. These samples purportedly contain sensitive operational and logistics data. To prevent the further release of these files, the group is demanding a ransom payment of 300,000 USD.

The screenshots provided by the attackers suggest that the stolen information includes a variety of business-critical documents. The data types identified in the leak include:

• Operational data
• Logistics records
• Supplier financial information
• Invoice data

The presence of such documentation, including operational efficiency reports, logistics tracking documents, freight invoices, supplier payment summaries, and various financial tables, highlights the potential impact of the breach on the company's internal processes.

About FALCO Electronics

FALCO Electronics is a technology company that was founded in 1991. The organization serves as a designer and manufacturer specializing in magnetic-based electronic components and assemblies. The company's technical expertise is focused on the power conversion, energy metering, and solar inverter sectors. FALCO Electronics maintains a global operational footprint, with active operations located in the USA, Mexico, China, and India.

Potential implications and risks

This alleged breach indicates that sensitive commercial and financial data within FALCO Electronics may be at risk of exposure. Because the leaked details involve supply chain and logistics processes, the incident could potentially create secondary risks for the company's business partners and suppliers. When logistics and supplier payment information is compromised, the entire supply chain ecosystem may face increased vulnerability.

Furthermore, given that the company maintains operations in Mexico, the breach may lead to complications regarding compliance with local data protection regulations. Organizations operating in multiple jurisdictions must navigate complex legal landscapes when sensitive data is compromised. Additionally, based on the known methods used by the Trigona group, there is a possibility that the exfiltrated data could be utilized in targeted phishing campaigns against the company or its partners.

While public information regarding the specific methods and capabilities of the Trigona group remains limited, this incident underscores the ongoing risks faced by the technology and manufacturing sectors. To mitigate such risks, organizations typically implement defensive measures such as multi-factor authentication, regular data backups, and continuous monitoring of network traffic to detect unauthorized exfiltration. Strengthening supply chain security and ensuring strict adherence to regional data privacy laws are also critical components of a robust cybersecurity posture.