fog ransomware group lists Gitlabs: Professional Computer, X-Pans, Propulsion Academy AG on its leak site

• Ransomware group: fog
• Country: Switzerland
• Sector: Technology
• Announcement date: January 30, 2025

The fog ransomware group claims a breach of multiple Swiss entities

On January 30, 2025, the ransomware group known as fog announced a cyberattack targeting several organizations based in Switzerland. According to a post on the group's leak site, the threat actor claims to have compromised multiple entities, including Gitlabs, Professional Computer, X-Pans, and Propulsion Academy AG. The group asserts that they have successfully exfiltrated sensitive information from these organizations, specifically targeting their proprietary assets.

Ransomware attacks often follow a pattern of double extortion, where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to release stolen data on public leak sites, attackers aim to pressure victims into paying a ransom to prevent the exposure of intellectual property or sensitive corporate secrets. In this instance, the group has moved to the leak phase by making the claimed data available via torrent links.

Details of the alleged data exfiltration

The claims made by the fog group suggest a significant breach involving technical assets. The group alleges that the data exfiltrated consists of approximately 1 GB of information for each of the targeted entities. This total volume of data is reportedly being distributed through torrent links on the group's platform. While the group has provided a specific size for the data, no specific ransom demand has been stated in the announcement.

The content of the leak is claimed to be highly sensitive, as it involves the core intellectual property of the affected companies. Specifically, the group claims to have stolen the following:

• Source codes

The availability of such critical assets on a public leak site represents a severe escalation in a cyberattack, as it transitions from a private extortion attempt to a public disclosure of proprietary information.

The targeted organizations

The entities listed in the announcement are based in Switzerland and operate within the technology sector. Gitlabs is identified as a technology and software development company. Additionally, the list includes Professional Computer, X-Pans, and Propulsion Academy AG. Propulsion Academy AG is described as an organization that provides training programs in the fields of data science and software development.

Potential impact and security implications

The alleged leak of source code poses substantial risks to the intellectual property rights of the affected entities. When source code is made public, it can expose the underlying logic and architecture of software products, potentially allowing third parties to identify and exploit security vulnerabilities within the organizations' software infrastructure. This can lead to further exploitation of the software used by the companies and their clients.

For Swiss-based organizations, such incidents may necessitate a thorough review of compliance processes under the General Data Protection Regulation (GDPR) and local data protection regulations. Furthermore, the exposure of technical data can facilitate secondary attacks, such as supply chain attacks or highly targeted phishing attempts against employees or partners. In many cases, such breaches can lead to a loss of trust from clients and stakeholders who rely on the integrity of the software provided by these firms.

To mitigate such risks, organizations typically focus on robust defensive measures. These include implementing strict access controls to protect sensitive repositories, employing continuous monitoring to detect unauthorized data exfiltration, and maintaining comprehensive incident response plans. Strengthening the security of the software development lifecycle (SDLC) is also a common defensive step to ensure that vulnerabilities are identified and patched before they can be exploited by threat actors using leaked information.