Gigatron.rs listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Serbia
• Sector: Technology
• Announcement date: February 20, 2023

Qilin ransomware group claims data breach at Gigatron.rs

The threat actor known as Qilin has listed data on its leak site that it alleges belongs to GIGATRON.RS. According to the announcement made on February 20, 2023, the group claims to have gained access to the organization's internal systems during an incident that occurred on the same day.

The group's announcement includes a detailed breakdown of data purportedly obtained from the organization's various servers and database backups. This type of activity is characteristic of modern ransomware operations, where attackers move beyond simple encryption to focus on data exfiltration to increase their leverage over the victim.

Details of the alleged data theft

The claims made by the Qilin group suggest a significant breach of internal systems. The group asserts that the information obtained includes sensitive files and critical system backups. Specifically, the announcement claims to contain the following types of data:

• Store database backups for G1-G69, G88, and G89
• Backups for CTRetail and GigatronWMS systems
• Sensitive information regarding employee disability status

Technical details provided in the form of screenshots appear to confirm the alleged extraction of data from various server addresses. While the group has provided this breakdown, no information was given regarding the total size of the data or the specific number of files involved. Additionally, no ransom demand has been disclosed in the current listing.

About Gigatron.rs

Gigatron is a leading retail chain based in Serbia, specializing in the sale of consumer electronics, computer hardware, and home appliances. It offers a wide range of technology products through both its physical stores and its online sales platform.

Potential impact and security implications

This alleged leak may pose a risk of exposing sensitive employee data and commercial operational information. For an organization operating in Serbia, this situation could potentially trigger legal proceedings regarding compliance with local data protection regulations. The exposure of operational backups could potentially create long-term security vulnerabilities for the organization's supply chain and business processes.

Given the Qilin group's known use of double-extortion tactics, the leaked data may potentially be used for identity theft or targeted phishing attacks. In double-extortion scenarios, attackers not only encrypt a company's data but also threaten to release sensitive information publicly if a ransom is not paid, creating a secondary layer of pressure on the victim.

To defend against such threats, organizations typically implement multi-layered security strategies. This includes robust access controls to prevent unauthorized entry into internal systems, regular monitoring of network traffic to detect unusual data transfers, and maintaining offline, immutable backups to ensure data integrity. Furthermore, protecting sensitive employee information through encryption and strict data governance is a critical component of modern cybersecurity defense.