Gitlabs: Omydoo, Ayomi, and ADULLACT targeted by fog ransomware group

• Ransomware group: fog
• Country: France
• Sector: Technology
• Announcement date: February 13, 2025

Fog ransomware group claims breach of Gitlab environments

The threat actor known as fog has announced a data breach involving three distinct entities. According to a post made on a leak site, the group claims to have successfully compromised the Gitlab environments belonging to Omydoo, Ayomi, and ADULLACT. This announcement, which was made public on February 13, 2025, marks a new development in the activities of this specific threat actor.

Ransomware groups often utilize leak sites to exert pressure on their victims. These platforms serve as a public stage where attackers list the organizations they have targeted, often accompanied by claims regarding the volume of data stolen. This tactic is a core component of double extortion, where attackers not only encrypt an organization's data but also threaten to publish sensitive information to coerce payment. By listing the names of the affected entities, the group aims to increase the visibility and potential impact of the breach.

Details of the claimed attack and data volume

The fog group's announcement specifies the timing and the scope of the alleged intrusion. The group claims the attack occurred on February 13, 2025, the same day the announcement was posted. The threat actor has listed the three organizations on their leak site, indicating that they have gained access to their Gitlab environments.

Regarding the volume of information involved, the group claims that they have acquired a significant amount of data. Specifically, the announcement indicates that there is approximately 7 GB of data for each of the three organizations. When aggregated, this totals the 21 GB of data claimed by the threat actor. However, despite the specific mention of the file size, the listing provides no detailed information regarding the specific nature or types of the leaked data. The content of the files remains unknown at this time.

Summary of claimed data

• No specific data types were identified in the listing.

Impact and organizational risks

This incident may pose significant risks to the operational continuity of the affected organizations. When a threat actor gains access to development environments like Gitlab, the integrity of the software development lifecycle could be at risk. Furthermore, if the claimed data is eventually published, secondary risks may emerge. These include the potential for identity theft or the execution of targeted phishing attacks directed at the customers and employees of the affected entities.

Given that the targeted entities are based in France, this breach may have significant legal implications under the General Data Protection Regulation (GDPR). Data breaches involving personal information often trigger strict notification requirements and regulatory scrutiny within the European Union. The potential for legal consequences underscores the importance of robust data protection frameworks.

General defensive considerations for technology sectors

For organizations operating within the technology sector, maintaining the security of development environments is critical. Common defensive steps to mitigate such risks include the implementation of multi-factor authentication (MFA) across all platforms, particularly for access to code repositories. Regular auditing of access logs can help detect unauthorized entries into sensitive environments. Additionally, maintaining offline, immutable backups and implementing strict principle of least privilege (PoLP) protocols can limit the movement of an attacker within a network.

At this stage, information regarding the fog group remains limited. Because there is a lack of public data concerning their specific motivations and technical methods, a definitive assessment of their operational patterns cannot be made. Organizations are encouraged to monitor for signs of unauthorized access and to maintain a high state of readiness for incident response.