Fort Rolins Collection Agency listed on malas leak site

• Ransomware group: malas
• Country: Indonesia
• Sector: Professional Services
• Announcement date: May 18, 2023

The threat actor known as malas has listed Fort Rolins Collection Agency on its leak site. According to the announcement, the organization has been targeted in a data breach, with the group claiming that sensitive information has been exfiltrated from the company's systems.

The claims made by the group

The malas group has listed data they claim belongs to Fort Rolins Collection Agency on their leak site. According to the threat actor, the organization ignored ransom demands and attempted to restore backups instead of negotiating with the attackers. As a consequence of this decision, the group alleges that they may have proceeded to publish the organization's data publicly.

This pattern is characteristic of modern ransomware tactics, often referred to as double extortion. In these scenarios, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information before the encryption process begins. By threatening to release this stolen data on public leak sites, the attackers aim to increase the pressure on the victim to pay the ransom, using the threat of reputational damage and legal consequences as leverage.

The data allegedly involved

Based on the leak site entry and the provided screenshot, the group claims to have exfiltrated specific types of information from the organization. The listing identifies the following affected data types:

• Email correspondence
• Configuration files

While the specific volume of data or the exact number of files has not been disclosed by the group, the nature of the claimed exfiltration suggests a significant breach of internal communications and system settings.

The organization

Fort Rolins Collection Agency is an entity operating within the professional services sector. The organization is located in Indonesia.

Analysis and implications

The alleged exfiltration of email correspondence may contain sensitive information regarding the organization's business operations and client relations. The disclosure of such data could lead to reputational damage and a loss of trust among third parties. Furthermore, it is possible that the organization may face legal consequences under Indonesian data protection regulations due to the exposure of this information.

Beyond the immediate impact on the organization's reputation, the leaked emails could potentially be utilized as a vector for phishing attacks or social engineering campaigns. When attackers gain access to internal email threads, they can mimic the tone and context of legitimate business communications to deceive employees or clients.

In such instances, organizations typically focus on several defensive and recovery steps. These include conducting thorough forensic investigations to determine the extent of the breach, resetting all compromised credentials, and auditing system configurations to ensure no backdoors were left behind. Strengthening email security protocols and implementing robust data loss prevention measures are also common defensive strategies to mitigate the risk of future exfiltration events. Information regarding this specific group remains limited.