Followup CRM listed on killsec ransomware leak site

• Ransomware group: killsec
• Country: United States
• Sector: Technology
• Announcement date: November 18, 2024

A major data leak claim against Followup CRM

The technology firm Followup CRM has been listed on the leak site of the ransomware group known as killsec. According to the claims made by the threat actor, a massive volume of corporate and customer data, totaling approximately 787 GB, has been made accessible through their platform. This announcement, posted on November 18, 2024, suggests a significant breach involving sensitive organizational information.

Details of the killsec announcement

The threat actor known as killsec has published data allegedly belonging to Followup CRM on its dedicated leak platform. The announcement states that information regarding the organization's internal systems is included in the breach and that the data is currently available for download. While the specific timing of the initial intrusion was not explicitly detailed, the listing itself was posted on November 18, 2024.

To support their claims, the group has shared sample images that appear to show various documents. These samples include various invoices and reporting documents, which the group uses to demonstrate the authenticity of the stolen information. This tactic is common in double extortion ransomware attacks, where threat actors not only encrypt an organization's data but also threaten to release it publicly to increase pressure during ransom negotiations.

Claimed data types and content

The announcement claims to contain a wide variety of sensitive information. The alleged dataset includes the following items:

• Customer contact details
• Project information
• Sales data
• Patient medical records
• Treatment details
• Internal reporting data
• Invoices
• Contract values
• Infrastructure details

The inclusion of such diverse data types suggests that the breach may have touched upon multiple layers of the organization's operations, from client-facing information to internal technical configurations.

About Followup CRM

Followup CRM is a technology company that provides customer relationship management and bid tracking software specifically designed for the construction industry. The company develops cloud-based solutions that help construction firms manage their sales processes and increase their win rates.

Risk assessment and industry implications

The alleged leak may pose significant risks, such as identity theft and targeted phishing attacks, for Followup CRM's customers and partners. The exposure of such specific information allows attackers to craft highly convincing social engineering campaigns. Furthermore, the inclusion of patient medical records could lead to serious compliance issues under regulations protecting health data, such as HIPAA, given the organization's United States-based operations.

From a business perspective, the exposure of financial records may result in the loss of trade secrets and damage to the company's competitive advantage. The volume and nature of the alleged dataset may create adverse effects on the organization's operational continuity. The killsec group, which emerged in 2023, is assessed to have hacktivist origins and has shifted toward ransomware activities.

For organizations operating in the technology and software-as-a-service sectors, such incidents highlight the importance of robust data protection strategies. Common defensive steps include implementing strict access controls, maintaining comprehensive logging to detect unauthorized movement, and ensuring that sensitive data, particularly medical or financial records, is encrypted both at rest and in transit. Regular security audits and employee training to recognize phishing attempts remain critical components of a modern cybersecurity posture.