Groupe ACTIVA targeted by ALPHV ransomware group

• Ransomware group: ALPHV
• Country: Cameroon
• Sector: Financial Services
• Announcement date: July 26, 2023

ALPHV claims breach of Groupe ACTIVA

The ALPHV ransomware group, also known as BlackCat, has published data allegedly belonging to Groupe ACTIVA on their dedicated leak site. This announcement, which was posted on July 26, 2023, follows a claimed attack date of April 21, 2023. The group has publicly targeted the organization, using highly critical language in their announcement to describe the company.

According to the claims made by the ALPHV group, they have successfully breached the network systems of Groupe ACTIVA. The threat actors allege that they have obtained confidential customer data during this intrusion. Furthermore, the group asserts that the organization possesses significant security vulnerabilities, which they claim allowed them to access and subsequently release the acquired data to the public. The announcement included a specific warning message directed at the customers of the organization.

Data types involved in the alleged leak

The information released by the attackers appears to include sensitive documentation. Based on screenshots provided by the group, the leaked content is said to consist of various documents that could expose private information. The specific types of data mentioned in the leak include:

• Insurance policies
• Invoices
• Payment orders
• Personal identification documents

While the group has released these screenshots, no specific information was provided regarding the total size of the data stolen or the exact number of files involved. Additionally, no information was provided regarding a specific ransom demand.

About Groupe ACTIVA

Groupe ACTIVA is a leading insurance group that was founded in 1998. The organization operates across Sub-Saharan Africa, providing a comprehensive range of both life and non-life insurance products. The group aims to conduct its operations in compliance with international standards within the financial services sector.

Impact and security implications

The alleged leak of this data carries significant risks for the organization and its clients. For the customers of Groupe ACTIVA, the exposure of personal identification documents, payment orders, and insurance policies may increase the risk of identity theft and fraud. Because the organization operates within the financial services sector, the exposed data could potentially be utilized by malicious actors in targeted phishing attacks.

From a regulatory and operational standpoint, the organization may face legal consequences under regional data protection regulations due to the exposure of sensitive information. Such incidents can lead to substantial reputational damage and cause significant disruptions to the organization's operational processes.

The ALPHV group is recognized as a Ransomware-as-a-Service (RaaS) operator. They are known for utilizing malware written in the Rust programming language. In such scenarios, organizations typically face the threat of double extortion, where attackers not only encrypt data but also threaten to leak it to pressure the victim into paying. To defend against such threats, organizations generally focus on strengthening network security, implementing robust access controls, and maintaining rigorous data protection protocols to mitigate the impact of potential breaches.