Great Lakes Wholesale Group data allegedly leaked by securotrop

• Ransomware group: securotrop
• Country: United States
• Sector: Professional Services
• Announcement date: July 22, 2025

Securotrop claims data breach against Great Lakes Wholesale Group

The threat actor group known as securotrop has listed data allegedly belonging to Great Lakes Wholesale Group on its leak site. According to the announcement made on July 22, 2025, the group claims to have exfiltrated a significant volume of information, totaling approximately 510 GB. This alleged breach involves a massive collection of files, with the group claiming that 251,927 files have been compromised in the incident.

The incident appears to have originated around June 19, 2025, according to the claims made by the threat actor. The group's decision to publish the data follows a breakdown in communication and negotiations. Specifically, securotrop states that the action of publishing the institution's data was taken because the organization did not meet their ransom demands, leading to a failure in negotiations.

Details of the alleged data exfiltration

The content of the leaked data is described as being highly sensitive, covering various aspects of the company's operations and client relations. The threat actor claims that the stolen information includes a wide array of documents that could be used to pressure the organization. The specific types of data said to be involved include:

• Customer contact information
• Sales reports
• Bank reconciliation summaries
• Inventory records
• Lease agreements
• Insurance certificates
• Tax documents
• Mailing lists containing over 10,000 email addresses

The exposure of such a diverse range of documentation, from financial summaries to tax documents and contact lists, highlights the potential impact of the breach on the organization's administrative and operational integrity.

About Great Lakes Wholesale Group

Great Lakes Wholesale Group is a US-based company specializing in the wholesale and distribution of various consumer goods. The company provides a wide range of products to retailers, serving as a key link in the supply chain for various consumer-facing businesses.

Risk assessment and industry implications

This breach may pose secondary risks such as identity theft and targeted phishing attacks for the institution's customers and business partners. Because the leaked data includes sensitive contact information and mailing lists, the risk of subsequent social engineering campaigns is heightened. Furthermore, the financial and operational nature of the exposed data could harm the institution's trade secrets and affect its competitive position in the sector.

As the institution is based in the United States, the incident may trigger legal proceedings under relevant state laws and data protection regulations. The nature of the data suggests that the organization could face significant regulatory scrutiny regarding how such sensitive information was protected.

The methods employed by securotrop suggest an intent to pressure institutions through a double-extortion strategy. In a typical double-extortion ransomware attack, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to threaten the victim with public disclosure. This tactic is designed to maximize leverage during ransom negotiations, as the threat of a data leak can cause significant reputational and legal damage even if the company can restore its systems from backups.

While public information about the securotrop group remains limited, their actions follow a pattern seen in modern ransomware operations. Organizations in the wholesale and distribution sector often face these risks due to the high volume of transaction data and the necessity of maintaining extensive supplier and customer databases. To defend against such threats, organizations typically implement multi-layered security strategies, including robust encryption, strict access controls, and continuous monitoring of their networks to detect unauthorized data movement.