FRESCA listed on Snatch ransomware leak site

• Ransomware group: Snatch
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: May 22, 2023

Snatch ransomware group claims attack on FRESCA

The threat actor known as Snatch has published an announcement on its dedicated leak site, claiming that an action has been carried out against the systems of the FRESCA brand. This announcement, which appeared on the group's platform, marks a new addition to the group's list of targets. The group officially added the organization to its public listing on May 22, 2023, and has asserted that it possesses proof files to support its claims regarding the breach.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's local systems to disrupt operations but also exfiltrate sensitive data. If the victim refuses to pay the ransom for the decryption key, the attackers threaten to publish the stolen information on these public platforms to cause reputational and legal damage.

Details of the alleged incident

According to the claims made by the Snatch group, the organization's systems were targeted in a cyberattack. While the group has listed FRESCA on its site, the specific details regarding the nature of the alleged incident remain limited to the group's announcement. The threat actor has stated that they hold evidence to validate their claims of having successfully breached the organization.

Regarding the specific information that may have been compromised, there is no information provided in the leak announcement or the registration records regarding the nature of the alleged leaked data. The listing does not specify the types of files, the volume of data, or the specific databases that were supposedly accessed during the operation.

The target organization

The organization identified in the leak announcement is the FRESCA brand. Based on the available information, the entity is associated with the domain coca-colacompany.com and is located in the United States. The organization operates within the Retail & E-Commerce sector.

Potential impact and security considerations

The Snatch group is recognized for a specific technical method involving the encryption of systems by restarting them in safe mode. Because of this approach, it is considered that the organization's operational continuity may be affected by such an attack. Furthermore, the alleged data leak could potentially lead to the exposure of the organization's customer and operational data.

Given that the organization is based in the United States, a potential data breach may result in legal consequences under state-level privacy laws and regulations. Additionally, there is a possibility that the leaked data could be utilized for identity theft or targeted phishing attacks against the organization or its stakeholders. The group involved, Snatch, has been active since 2018 and has been operating its own leak site since 2021.

For organizations operating within the retail and e-commerce sectors, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and ensuring that all software and operating systems are patched against known vulnerabilities. Monitoring network traffic for unusual activity can also help in the early detection of unauthorized exfiltration attempts.