I&G Brokers Database allegedly targeted by Ransomed

• Ransomware group: Ransomed
• Country: Åland Islands
• Sector: Financial Services
• Announcement date: October 13, 2023

The threat group known as Ransomed has listed data allegedly belonging to the I&G Brokers Database on its leak site. This announcement, made on October 13, 2023, claims that the organization's data has been compromised. The group has provided an external link for the download of the mentioned data, though the specific nature of the breach remains unconfirmed by the victim.

The details of the claim

According to the announcement posted on the Ransomed leak site, the group claims to have successfully breached the I&G Brokers Database. The group has shared an external link intended for the download of the allegedly stolen information. At this stage, public information regarding the Ransomed group remains limited, making it difficult to ascertain their specific tactics, techniques, or long-term motivations.

Ransomware leak sites serve as a platform for threat actors to exert pressure on their victims. In many modern cyberattacks, groups employ a strategy known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. By threatening to release this stolen information on a public leak site, the attackers aim to coerce the victim into paying a ransom to prevent the exposure of sensitive corporate or customer information.

Data involved in the alleged breach

Regarding the content of the allegedly leaked data, the listing provides no detailed information. The group has provided only a download link without specifying the types of files or the volume of information contained within the package. Consequently, the listing names no specific data types.

The organization and the sector

The entity identified in the leak is the I&G Brokers Database, which operates within the financial services sector. The organization is associated with the Åland Islands. Because the group's claims involve an entity in the financial services sector, the potential impact of such a breach is significant due to the sensitive nature of the industry's operations.

Implications and industry risks

The fact that the allegedly leaked data belongs to an entity in the financial services sector may bring the risk of exposure for customer and operational data. The availability of such data to third parties could create a basis for identity theft and targeted phishing attacks. When sensitive financial information is exposed, attackers often use it to craft highly convincing social engineering campaigns, targeting individuals or other institutions to gain further access or fraudulent funds.

Furthermore, the public disclosure of the data may lead to reputational damage for the institution and expose it to secondary extortion attempts. Secondary extortion occurs when attackers contact the victim multiple times or target the victim's clients directly to demand additional payments. Additionally, it is expected that legal processes may be triggered in accordance with the data protection regulations in the region where the institution operates.

To defend against such threats, organizations in the financial sector typically focus on robust defensive measures. These include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data exfiltration, and ensuring that data is encrypted both at rest and in transit. Regular security audits and employee training regarding phishing awareness are also standard practices to mitigate the risks posed by ransomware groups and the potential for secondary extortion.