Hensoldt listed on lorenz ransomware leak site

• Ransomware group: lorenz
• Country: France
• Sector: Government & Defense
• Announcement date: January 11, 2022

The Hensoldt organization has been listed on the lorenz ransomware group's leak site. According to the announcement made on January 11, 2022, the threat actor claims to have compromised a significant volume of data belonging to the company.

The claimed attack event

The threat actor known as lorenz has listed Hensoldt on its dedicated leak site, claiming to possess data belonging to the organization. This announcement specifically highlights the entity's operations in France. According to the claims made by the threat actor, the total volume of the compromised data is 38 GB. The announcement was made on the same day as the claimed attack date, which is January 11, 2022.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers do not only encrypt an organization's systems to demand a ransom for decryption but also threaten to release sensitive information to pressure the victim into paying. By publishing names of high-profile targets, these groups aim to increase the visibility and pressure of their extortion attempts. While the presence of an organization on a leak site is a serious indicator of a potential breach, the accuracy and scope of the alleged data may only be clarified following an internal investigation by the organization itself.

Data involved in the claim

The information provided by the threat actor suggests that the breach involves specific types of corporate and personal information. Based on the available screenshots, the data includes lists containing contact information of employees. The specific elements identified in the leaked content include:

• Employee contact information
• Corporate directory

The leaked content reportedly contains details such as names, job titles, email addresses, and phone numbers of the organization's staff. No information was provided regarding the specific ransom demand or the exact number of files involved in the leak.

The organization profile

HENSOLDT is a Germany-based technology company specializing in sensor solutions and defense electronics. The company is notably involved in the development of radar, optronics, and electronic warfare systems. Furthermore, the company produces critical surveillance and protection technologies that are utilized for both military and civil security applications.

Security implications and sector risks

This leak may pose a significant risk for targeted phishing attacks and social engineering attempts directed at the organization's employees. When employee contact information, such as names and phone numbers, is exposed, attackers can craft highly convincing messages to deceive staff members into revealing further credentials or installing malware.

Given that the entity operates within the defense sector, the exposure of such data could potentially impact corporate security protocols. Organizations in the defense and government sectors are often considered high-value targets due to the sensitive nature of their operations and the critical technologies they develop. For such entities, maintaining robust security measures is essential to protect both corporate intellectual property and national security interests.

Furthermore, as the entity is located within the European Union, risks related to data protection violations under GDPR should be considered. The exposure of personal employee data necessitates a careful evaluation of regulatory compliance and data privacy obligations. While information about the lorenz group remains limited in the public domain, organizations facing similar threats often implement defensive steps such as enhanced employee awareness training, multi-factor authentication, and rigorous monitoring of network traffic to mitigate the impact of social engineering and unauthorized data exfiltration.