fog ransomware group lists Mozo Grau (mozo-grau.com) on its leak site

• Ransomware group: fog
• Country: Spain
• Sector: Healthcare
• Announcement date: February 13, 2025

Fog ransomware group claims data breach at Mozo Grau

The fog ransomware group has listed the Spanish healthcare organization Mozo Grau on its leak site. According to the announcement made on February 13, 2025, the threat actor group claims to have successfully exfiltrated a significant amount of data from the company's systems. This incident follows a pattern often seen in modern cyberattacks where threat actors target specific industries to maximize the impact of their extortion attempts.

The group's announcement, which occurred on the same day as the claimed attack, asserts that they have obtained 72.2 GB of data belonging to the organization. While the specific methods used to infiltrate the network remain unknown, the volume of data claimed suggests a substantial breach of the company's digital infrastructure. As is common with ransomware leak sites, the group uses these platforms to host information regarding their targets, often as a means of exerting pressure during negotiations.

Details of the claimed data theft

The information provided by the fog group suggests that the breach involves a wide variety of sensitive files. The group has categorized the stolen data to highlight the potential impact of the leak, specifically referencing the company's operations within the dental surgery and implantology industry. The contents of the alleged breach include a mix of personal, financial, and legal documentation.

According to the group's claims, the following types of data have been compromised:

• Employee contact information
• Customer contact information
• Financial documents
• Identity numbers
• Confidential agreements
• License documents

The inclusion of identity numbers and contact details for both employees and customers significantly increases the risk profile of this incident. Such data is highly valuable on illicit markets and is frequently used for secondary malicious activities.

About Mozo Grau

Mozo Grau is a healthcare technology company based in Spain. Since its establishment in 1972, the company has specialized in the field of dental technology. Their core business involves the development and provision of high-quality implant systems and surgical equipment. They are recognized for their expertise in dental implants and prosthetic solutions, serving the dental industry with specialized tools and components.

Potential risks and industry implications

This incident highlights the significant risks associated with double extortion tactics, a method where attackers not only encrypt a victim's data but also threaten to leak it publicly to compel payment. By threatening to release sensitive information, ransomware groups aim to create maximum operational and reputational pressure on the target organization.

The exposure of the alleged data presents several critical risks. For the employees and customers of Mozo Grau, the theft of contact information and identity numbers could lead to identity theft or highly targeted phishing attacks. Furthermore, because the company is based in Spain, the exposure of such personal data may fall under the regulatory scope of the General Data Protection Regulation (GDPR), which could lead to significant legal and regulatory consequences for the organization.

From a business perspective, the disclosure of internal financial documents and confidential commercial agreements could result in a loss of competitive advantage. Additionally, the breach of such sensitive information can create supply chain risks, as partners and clients may become concerned about the security of their own data shared with the company. While public information regarding the fog group is limited and their specific methods remain uncertain, the impact of such a breach on a specialized healthcare provider can be profound. Organizations in this sector often prioritize robust defensive measures, such as multi-factor authentication, regular security audits, and strict access controls, to mitigate the risk of such devastating data exfiltration events.