Fondation De Verdeil targeted by noescape ransomware group

• Ransomware group: noescape
• Country: Switzerland
• Sector: Education
• Announcement date: August 15, 2023

Noescape group claims data breach at Fondation De Verdeil

The ransomware group known as noescape has listed a significant amount of data allegedly belonging to the Fondation De Verdeil on its dedicated leak site. According to the announcement made on August 15, 2023, the group claims to have exfiltrated 40 GB of data from the organization. This incident follows a claimed attack date of August 8, 2023.

The group alleges that they successfully gained unauthorized access to the networks belonging to the Fondation De Verdeil and subsequently compromised its data. In a move characteristic of modern cyber extortion, the noescape group has accused the foundation's management of attempting to conceal the breach. The attackers have stated that if the ransom demand is not met, all of the stolen data will be released to the public. It is important to note that public information regarding the specific identity and operations of the noescape group remains limited.

Sensitive information allegedly compromised

The screenshots provided by the attackers in their leak announcement suggest a highly sensitive breach involving a wide variety of personal and institutional information. The data allegedly stolen includes highly private documentation that could pose significant risks to the individuals involved. The types of information identified in the screenshots include:

• Client personal data
• Employee personal data
• Contracts
• Passports
• Credit card details
• Insurance documents
• Medical certificates
• Photos and documents related to children

The presence of such diverse and sensitive data types highlights the potential impact of the breach on the privacy of both staff and the vulnerable populations served by the institution.

About Fondation De Verdeil

Fondation De Verdeil is an educational institution located in the Canton of Vaud, Switzerland. The organization provides specialized pedagogical services specifically designed for children and adolescents facing developmental and learning difficulties. With a workforce of approximately 500 employees, the foundation operates several different centers to deliver specialized education and essential support services to its clients.

Analysis and potential implications

The nature of the data allegedly leaked presents severe risks, particularly regarding identity theft and fraud. These risks are especially acute for the foundation's employees and the children who receive services at the institution. Because the organization operates within Switzerland, it may be subject to specific legal obligations, such as data breach notification requirements under the regulations set by the Federal Data Protection and Information Commissioner (FDPIC).

The exposure of sensitive medical and financial information carries the potential for significant reputational damage and may lead to various legal proceedings against the institution. The tactics employed by the noescape group appear to follow the double-extortion model. In this scenario, attackers do not just encrypt data to disrupt operations, but they also steal sensitive information to use as leverage, threatening to leak it to increase pressure on the victim to pay the ransom.

Furthermore, the publication of such sensitive datasets could facilitate secondary attacks. For instance, the stolen information could be used to launch highly targeted phishing campaigns, where attackers use personal details to gain the trust of the victims. For organizations in the education and social services sectors, maintaining robust cybersecurity defenses is critical to protecting the privacy of vulnerable individuals and ensuring the continuity of essential pedagogical services.