Gitlabs: hemio.de, SOLEIL, and Devlion targeted by fog

• Ransomware group: fog
• Country: Germany
• Sector: Technology
• Announcement date: February 4, 2025

Fog ransomware group claims data breach against multiple entities

The threat actor known as fog has officially listed several organizations on its dedicated leak site, claiming to have successfully compromised their systems. According to the announcement, the group has targeted hemio.de, SOLEIL, and Devlion, asserting that they have obtained significant amounts of sensitive information from these entities.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers do not merely encrypt an organization's data to demand a ransom for decryption; they also threaten to publish stolen information on public forums to pressure the victim into paying. This tactic aims to maximize leverage by threatening the target's reputation and operational integrity through the exposure of proprietary information.

Details of the alleged leak

The incident was announced on February 4, 2025, with the group claiming the attack occurred on the same day. The threat actor alleges that the breach resulted in a substantial volume of stolen data. Specifically, the group claims to have released 5 GB of data for each of the three affected entities, resulting in a total claimed data size of 15 GB. While the group has published this information, it is important to note that public information regarding the specific methods or identity of the fog group remains limited.

The leak announcement specifically claims that the following types of information have been compromised:

• Source codes

The exposure of source code is a critical security concern. When an attacker gains access to an organization's codebase, they can perform deep analysis to identify zero-day vulnerabilities, hardcoded credentials, or logic flaws that can be exploited in future, more targeted attacks.

Potential impact and organizational risks

The alleged theft of source code carries significant implications for the targeted organizations. For technology-focused entities, such a leak may compromise their core intellectual property, potentially undermining their competitive advantage and market position. Furthermore, the exposure of software infrastructure details could provide a roadmap for other threat actors to launch secondary attacks against the organizations or their clients.

For specialized research facilities, such as SOLEIL, the risks extend to the potential exposure of sensitive research data and proprietary operational processes. Such breaches can disrupt scientific workflows and compromise the integrity of long-term research projects. Additionally, organizations facing such incidents may encounter regulatory obligations under the General Data Protection Regulation (GDPR), which requires specific notification procedures following a data breach.

Beyond the immediate technical impact, there are broader supply chain security risks. If the leaked code is integrated into products used by third parties, the vulnerability may propagate through the supply chain. Organizations can mitigate these risks by implementing robust security measures, such as regular code audits, strict access controls, and comprehensive incident response plans. Defensive strategies typically include maintaining offline backups, implementing multi-factor authentication, and monitoring for unauthorized data exfiltration to detect such incidents early in the attack lifecycle.

Summary of the threat actor claim

The fog group's claim represents a significant potential risk to the affected organizations' intellectual property and operational security. As the group's profile remains largely unknown in the public domain, the incident highlights the ongoing challenge posed by ransomware groups that utilize public leak sites to escalate their extortion efforts.