Formosa Chang listed on ralord ransomware leak site

• Ransomware group: ralord
• Country: Taiwan
• Sector: Hospitality
• Announcement date: March 30, 2025

Taiwanese restaurant chain targeted by ralord ransomware group

The Taiwan-based restaurant chain Formosa Chang has been listed on a leak site by the threat actor known as ralord. The announcement, made on March 30, 2025, marks a significant incident for the hospitality organization, as the group claims to have successfully compromised the company's digital infrastructure.

Details of the alleged attack and extortion attempt

According to the claims made by the threat actor group ralord, the attack involved the encryption of a significant portion of the organization's network. In addition to the disruption caused by encryption, the group asserts that they have exfiltrated 50 GB of data from the company's systems. The incident was officially announced on the group's leak site on March 30, 2025, the same day the group claims the attack took place.

The group is employing a double extortion tactic, a common method used by modern ransomware operators. In these scenarios, attackers do not merely encrypt files to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish the allegedly stolen data on their public leak site, the threat actors aim to exert maximum pressure on the organization to meet their demands. While the specific ransom demand has not been disclosed, the threat of data exposure remains the primary tool for coercion.

Scope of the alleged data exfiltration

The leak announcement provides a detailed list of the types of information the group claims to have stolen. The stolen data reportedly includes a wide variety of sensitive business and operational files. According to the group, the exfiltrated content consists of:

• Credentials
• Secret recipes
• Project source codes
• Partner information
• Payment records
• Corporate documents

The presence of such diverse data types, ranging from technical source code to proprietary culinary recipes and financial records, suggests a broad compromise of the organization's internal systems and file servers.

About Formosa Chang

Formosa Chang is a popular Taiwanese restaurant chain famous for its traditional braised pork rice. With numerous locations across Taiwan, the company is a significant food business representing local culinary culture.

Potential impact and industry implications

This alleged data breach may pose a significant risk of exposure for Formosa Chang's sensitive business information and operational data. The potential disclosure of secret recipes and partner details could harm the organization's competitive advantage and weaken supply chain security. Furthermore, the presence of payment records and credentials may create secondary risks for employees and customers, such as identity theft or targeted phishing attacks.

From a regulatory perspective, the organization may face legal obligations under Taiwan's data protection regulations due to the nature of the potentially compromised information. In the hospitality sector, where brand reputation and proprietary recipes are central to business success, such breaches can have long-lasting consequences. While information about the ralord group remains limited, the incident highlights the ongoing risks faced by large-scale food and beverage enterprises.

To defend against such threats, organizations in the hospitality sector can implement various security measures. These include maintaining robust backup solutions to mitigate the impact of encryption, implementing multi-factor authentication to protect credentials, and conducting regular network segmentation to limit the lateral movement of attackers. Additionally, monitoring for unauthorized data exfiltration and maintaining strict access controls for sensitive files, such as recipes and financial records, are essential components of a modern cybersecurity posture.