Gamka Sales Co. Inc listed on killsec leak site

• Ransomware group: killsec
• Country: United States
• Sector: Professional Services
• Announcement date: December 21, 2024

Gamka Sales Co. Inc listed by killsec

The threat actor known as killsec has listed Gamka Sales Co. Inc on their leak site. According to the announcement made on December 21, 2024, the group claims to have obtained data belonging to the organization and has proceeded to make this information publicly available.

Details of the claimed breach

The killsec group has claimed that the data allegedly belonging to Gamka Sales Co. Inc was obtained through the Accolent ERP software. By publishing the institution's data on their leak site, the group states they have made the information accessible to the public. This method of operation is common among modern ransomware groups that utilize leak sites to exert pressure on their targets.

In many cyberattacks, threat actors employ a tactic known as double extortion. In these scenarios, the attackers do not only encrypt an organization's systems to disrupt operations but also steal sensitive data. The threat of releasing this stolen data on a public leak site serves as a secondary layer of leverage to coerce the victim into meeting ransom demands. While the specific details regarding the ransom demand or the total volume of data stolen were not provided in the announcement, the act of publishing data is a hallmark of this strategy.

Affected data types

Based on the screenshots shared by the threat actor, the leaked information includes various technical and commercial records. The specific data types identified in the claim include:

• Purchase orders
• ERP data

The presence of such data in a leak suggests that the attackers may have gained access to core business processes. The claim that the breach occurred via the Accolent ERP software may indicate the presence of a vulnerability or unauthorized access within that specific system.

About Gamka Sales Co. Inc

Gamka Sales Co. Inc is a New York-based company specializing in the sale, rental, and service of construction and industrial equipment. They focus primarily on concrete processing, cutting, and drilling equipment.

Risk assessment and industry implications

The potential leak of this information may pose risks to the institution's commercial operations and its various supply chain relationships. Because the exposed data includes purchase orders and technical tables, there is a possibility that the information could be used in targeted phishing attacks against the institution's business partners.

Furthermore, as a US-based institution, the organization may face data privacy obligations under relevant state laws and federal regulations due to the nature of the incident. The impact of such a breach can extend beyond immediate operational disruptions to include long-term reputational damage. Given that the killsec group is reported to have hacktivist origins, this action may be intended to damage corporate reputation in addition to potential financial gain.

For organizations operating in the professional services and industrial equipment sectors, maintaining robust security posture is critical. Defensive steps typically include implementing multi-factor authentication, conducting regular vulnerability assessments of ERP systems, and ensuring that all software is patched against known exploits. Additionally, organizations should focus on supply chain security to mitigate the risk of secondary attacks targeting their partners through stolen business documentation.