IKP listed on noescape ransomware leak site

• Ransomware group: noescape
• Country: Austria
• Sector: Professional Services
• Announcement date: September 20, 2023

The noescape ransomware group claims IKP data breach

The communications agency IKP has been listed on the leak site of the noescape ransomware group. According to the threat actor, the organization has been targeted in a cyberattack, resulting in a significant data breach. The announcement regarding this incident was discovered on September 20, 2023, while the claimed date of the attack is recorded as September 10, 2023.

The noescape group claims to have obtained 50 GB of data belonging to IKP. The threat actor has stated that they will publish the entire dataset if the organization does not respond to their demands. While the group has made these claims on their leak site, no specific ransom demand has been disclosed in the available information.

Details of the claimed data theft

The data allegedly stolen by the noescape group includes a wide variety of sensitive information. The threat actor claims that the stolen files contain highly personal and confidential documentation. Based on the information provided by the group, the affected data includes the following items:

• Employee passports
• Client passports
• Personal data
• Financial documents
• Contracts
• Tax records

The scope of the claimed data suggests a significant breach of privacy and corporate confidentiality. The presence of identity documents such as passports and personal identifiers indicates a high risk of identity theft for the individuals involved. Furthermore, the inclusion of financial and tax records suggests that the breach extends into the sensitive administrative and fiscal operations of the firm.

The nature of double extortion tactics

This incident follows a pattern often seen in modern ransomware operations known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption phase. The attackers then use the threat of leaking this sensitive information on public leak sites as leverage to pressure the victim into paying a ransom. This tactic increases the pressure on an organization, as the risk shifts from mere operational downtime to long-term reputational damage and legal consequences resulting from the exposure of private data.

About IKP

IKP is an award-winning communications agency based in Austria. The firm specializes in public relations, media relations, and digital communication. As a strategic player in the communications sector, IKP provides strategic communication consulting and corporate communication management services to its clients.

Impact and risks associated with the leak

The potential consequences of this leak are multifaceted. For the employees and clients of IKP, the exposure of passports and personal information significantly increases the risk of identity theft. For the organization itself, operating within Austria means that it may face administrative sanctions under GDPR data protection obligations due to the nature of the exposed data.

Beyond legal and regulatory risks, the leak of confidential agreements and financial data could lead to secondary risks for third parties involved with the agency. The exposure of such sensitive information can also create negative impacts on the organization's commercial reputation. Information regarding the noescape group remains limited.

In such scenarios, organizations in the professional services sector typically focus on strengthening their defensive postures. Common defensive steps include implementing robust multi-factor authentication, maintaining regular offline backups, and conducting thorough employee training to prevent initial access through phishing. Additionally, organizations often conduct forensic investigations to determine the full extent of a breach and work to comply with regional data protection regulations to mitigate legal exposure.