Gossler, Gobert & Wolters Group targeted by donutleaks

• Ransomware group: donutleaks
• Country: Germany
• Sector: Financial Services
• Announcement date: September 19, 2023

Donutleaks claims data exfiltration from Gossler, Gobert & Wolters Group

The threat group known as donutleaks has listed the German-based financial services firm Gossler, Gobert & Wolters Group on its leak site. According to the group's announcement, they claim to have exfiltrated 2.6 TB of data belonging to the organization. This incident follows a pattern common in modern cyberattacks where threat actors use leak sites to pressure victims into meeting specific demands.

In many such scenarios, threat actors employ a tactic known as double extortion. In this model, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of leaking this stolen data on a public forum serves as additional leverage to coerce the victim into paying a ransom. While the specific ransom demand in this instance has not been disclosed, the group has issued a notice stating that the data will be leaked if their demands are not met.

Details of the alleged breach

The threat actor, donutleaks, alleges that they gained unauthorized access to the organization's internal systems. Specifically, the group claims to have successfully breached the organization's SQL databases and file servers. This type of access allows attackers to bypass traditional perimeter defenses to reach the core data repositories that hold an organization's most sensitive information.

The data allegedly stolen by the group is reported to be quite extensive, spanning a decade of records. The specific types of information identified in the claim include:

• SQL databases
• File server contents
• SEPA transaction information spanning the last 10 years

Publicly available information regarding the specific methods, tools, or identity of the donutleaks group remains limited, making it difficult for security researchers to attribute the attack or understand the group's full operational capabilities.

About Gossler, Gobert & Wolters Group

Gossler, Gobert & Wolters (GGW) Group is a financial services company based in Germany. The organization specializes in insurance brokerage and risk management, providing a variety of insurance solutions and consulting services to its corporate clients. Given its role in the financial sector, the organization handles significant amounts of sensitive client information and financial transaction data.

Potential impact and industry implications

The alleged breach poses significant risks to both client privacy and the operational continuity of the organization. Because the organization operates within the financial services sector, the presence of SEPA transaction data is particularly concerning. The exposure of such information could increase the likelihood of financial fraud and identity theft for the affected clients.

Furthermore, the organization may face substantial regulatory scrutiny and legal obligations. Under frameworks such as the General Data Protection Regulation (GDPR), companies are required to protect personal data and report breaches that could impact individuals. Failure to comply with these regulations can result in heavy fines and legal action. Additionally, the breach could lead to severe reputational damage, which is especially critical for an organization that provides cyber insurance services.

Secondary risks following such an event often include targeted phishing campaigns directed at the organization's clients, as attackers may use the stolen information to craft highly convincing fraudulent communications. There is also the potential for supply chain attacks, where the breach of one service provider is used as a stepping stone to reach their clients or partners. To defend against such threats, organizations in this sector typically implement robust data encryption, multi-factor authentication, and continuous monitoring of database and file server access logs.