Global Export Marketing Co. Ltd. targeted by Inc Ransom

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Professional Services
• Announcement date: October 30, 2023

Inc Ransom claims data breach at Global Export Marketing Co. Ltd.

The ransomware group known as Inc Ransom has listed Global Export Marketing Co. Ltd. on its leak site, claiming to have made various file archives available for download. According to the announcement made on October 30, 2023, the group alleges that the breach occurred on October 29, 2023. While the group has published these claims, the specific size of the data and the exact ransom demand remain unknown.

Inc Ransom is a threat actor that emerged in mid-2023. The group is known to employ double-extortion tactics, a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. In such scenarios, the threat actors threaten to leak the stolen data on public forums or leak sites if the ransom is not paid, thereby increasing the pressure on the victim through the threat of reputational damage and regulatory scrutiny.

Details of the alleged data leak

The announcement on the leak site includes numerous compressed files and document samples that allegedly belong to the company's operational processes. Based on the information provided, the leaked content appears to consist of a wide variety of sensitive files. Screenshots associated with the claim show multiple file archives containing critical information.

The data allegedly exposed includes the following types of information:

• Identity information
• Passport data
• Email archives
• Budget reports
• Employee data

The presence of such sensitive personal identification information among the allegedly leaked data may increase the risk of identity theft for the affected employees and customers. Furthermore, the nature of these files, which include desktop backups and various internal documents, suggests a significant breach of operational privacy.

About Global Export Marketing Co. Ltd.

Global Export Marketing Co. Ltd. (GEMCO) is an export and marketing company that helps American brands reach international markets. Operating for over 31 years, the firm provides global distribution services in the food and consumer goods sectors.

Analysis and potential implications

The incident highlights the ongoing risks faced by professional services firms. Given that the company is US-based, legal processes may be triggered under data breach notification obligations and state-level privacy laws. The use of the double-extortion method by Inc Ransom may increase pressure on the organization, potentially leading to secondary ransom demands or the broader exposure of the data.

Considering the operational history of the Inc Ransom group, the leaked data could potentially be utilized in targeted phishing attacks. When attackers possess email archives and identity information, they can craft highly convincing messages to deceive employees or clients. This makes the organization a target for subsequent social engineering attempts.

For organizations operating in similar sectors, it is vital to review data security protocols and notify the affected parties. Common defensive steps for organizations include implementing robust multi-factor authentication, maintaining regular offline backups, and ensuring strict access controls to sensitive data archives. Monitoring for unusual network activity and conducting regular security awareness training can also help mitigate the impact of such attacks.