GFZ Helmholtz Centre for Geosciences listed on fog ransomware leak site

• Ransomware group: fog
• Country: Germany
• Sector: Government & Defense
• Announcement date: February 4, 2025

GFZ Helmholtz Centre for Geosciences targeted by fog ransomware group

The GFZ Helmholtz Centre for Geosciences has been listed on the leak site of a threat actor known as fog. According to the announcement made by the group, the organization's GitLab source codes have been compromised in a recent cyberattack.

Details of the claimed attack

The fog group published an announcement on its leak site regarding the targeting of the GFZ Helmholtz Centre for Geosciences. While the announcement was posted on February 4, 2025, the group claims the attack itself took place on February 1, 2025. The threat actor alleges that unauthorized access was successfully gained to the organization's GitLab source code repositories.

To facilitate the potential release of the stolen information, the group has provided a torrent link. This action suggests that the group intends to make the data available to the public. The presence of such links is a common tactic used by ransomware groups to increase pressure on their targets during extortion attempts.

Data and impact of the breach

The announcement specifically claims that source codes obtained from the organization's GitLab platform have been leaked. While the specific file count and the exact ransom demand remain unknown, a screenshot provided by the group indicates that the size of the data is approximately 5 GB. The following data type has been identified as affected:

• Source codes

In many modern ransomware campaigns, groups employ a strategy known as double extortion. In these scenarios, attackers do not just encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. By threatening to leak this data on public forums or leak sites, the attackers aim to exert maximum pressure on the victim to pay a ransom, leveraging the threat of reputational damage or legal consequences.

About the GFZ Helmholtz Centre for Geosciences

The GFZ Helmholtz Centre for Geosciences serves as Germany's national research center for Earth sciences. The institution is dedicated to conducting both fundamental and applied research across various critical scientific fields, including geophysics, geology, and the study of climate change.

Security implications and defensive considerations

This incident may pose a significant risk to the organization's intellectual property and the security of its research data. The exposure of sensitive source code is particularly dangerous, as it could potentially lead to the identification of vulnerabilities within the organization's digital infrastructure. Such information can be exploited by malicious actors to facilitate secondary attacks against the institution.

Furthermore, because the organization operates within Germany, this breach may have significant legal implications regarding data protection obligations under the General Data Protection Regulation (GDPR). Organizations operating in highly regulated environments must be prepared for the legal and compliance challenges that follow a data exposure.

While information regarding the specific tactics and identity of the fog group remains limited, their methods appear aimed at using the threat of data disclosure to exert pressure. For organizations facing similar threats, it is advisable to conduct a thorough review of leaked code to identify potential security vulnerabilities. Additionally, organizations should perform comprehensive audits of their systems to detect and mitigate any unauthorized access that may have occurred during the breach.