Grupo PRIDES allegedly targeted by Noescape ransomware group

• Ransomware group: Noescape
• Country: Costa Rica
• Sector: Technology
• Announcement date: December 1, 2023

Noescape claims a major breach at Grupo PRIDES

The ransomware group known as Noescape has claimed responsibility for a cyberattack targeting Grupo PRIDES. According to an announcement made on a leak site, the threat actor alleges they have successfully compromised the network of the organization. While the group asserts that they have exfiltrated a significant amount of information, the company has reportedly denied the incident.

The claim, which was officially posted on a leak site on December 1, 2023, suggests that the breach occurred around November 26, 2023. The threat actor is reportedly using the stolen information as leverage, threatening to publish the data to the public to force the company's management into negotiations. This tactic is a hallmark of modern ransomware operations, where the goal is not just to encrypt systems, but to use the threat of exposure to extract payment.

Details of the alleged data exfiltration

The Noescape group claims to have stolen a total of 60 GB of data from the company's servers. The nature of the stolen information is highly sensitive, spanning various categories of corporate and personal documentation. The group alleges that the exfiltrated data includes a wide range of files that could be used for extortion or further malicious activities.

The specific types of data allegedly stolen include:

• Customer personal data
• Employee passport and ID information
• Financial records
• Legal documents
• Contracts

Beyond these specific categories, the group claims the cache contains legal and notarized documents, confidential contracts, banking and financial records, tax documents, invoices, SQL databases, backup files, and various corporate reports. The breadth of this alleged data set suggests a deep penetration into the organization's digital infrastructure.

About Grupo PRIDES

Grupo PRIDES is a technology company based in Costa Rica. With over 39 years of experience in the industry, the organization specializes in software development and telecommunications solutions. The company's primary operations are focused within the fields of software marketing and IT services, making them a significant player in the technology sector.

Analysis and potential implications

This alleged breach highlights the significant risks faced by organizations in the technology and IT services sectors. The sensitivity of the data claimed to be stolen—including employee identification and financial records—suggests that both employees and customers of Grupo PRIDES may be exposed to risks such as identity theft. Furthermore, given the company's role in software and telecommunications, the leaked data could potentially lead to secondary attacks involving trade secrets or third-party agreements.

Because the organization is based in Costa Rica, such a breach may result in legal consequences under local data protection regulations. The group involved, Noescape, appears to utilize double-extortion tactics, a method where attackers both encrypt data and threaten to leak it to maximize pressure on the victim. While public information regarding the Noescape group remains limited, their use of these tactics is a growing trend in the cyber threat landscape.

For organizations operating in similar sectors, this incident underscores the importance of robust defensive measures. To mitigate the risk of such breaches, companies often implement multi-factor authentication, continuous network monitoring, and strict access controls. Additionally, maintaining regular, offline backups and conducting regular security audits can help reduce the impact of an exfiltration event. The potential for reputational damage and operational disruption following such an incident remains a critical concern for modern enterprises.