Inet listed on fog ransomware leak site

• Ransomware group: fog
• Country: Thailand
• Sector: Technology
• Announcement date: March 6, 2025

Fog ransomware group claims data breach at Inet

The Thailand-based technology company Inet has been listed on a leak site by the threat actor known as fog. The announcement, which was published on March 5, 2025, involves a significant amount of data allegedly belonging to the organization.

Ransomware groups often utilize leak sites as part of a double extortion strategy. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to pressure the victim into paying a ransom. By publishing stolen data on public or semi-public platforms, these groups attempt to maximize the reputational damage and legal pressure exerted on the target company.

Details of the alleged attack

According to the post made by the fog group, the incident involves 90 GB of data that was allegedly extracted from the organization's GitLab infrastructure. The threat actor provided torrent and web links to facilitate the access and distribution of the claimed data. While the announcement was made in early 2025, the group claims the actual attack took place on December 20, 2021.

The discrepancy between the claimed attack date and the announcement date is a notable detail in this incident. In many cyberattack scenarios, attackers may hold stolen data for extended periods before deciding to publish it on a leak site, or they may use such discrepancies as a tactic during negotiations.

Data and infrastructure involvement

The listing specifically identifies the source of the alleged theft as the organization's GitLab infrastructure. GitLab is a widely used platform for version control and software development workflows. While the group claims the data originated from this specific environment, the post does not provide specific technical details regarding the exact content of the files.

• Source code
• Configuration files
• API keys

The exposure of data from a development environment is particularly concerning for technology providers. Such leaks can potentially compromise an organization's intellectual property. While the specific content of the 90 GB of data has not been fully detailed, the nature of the infrastructure targeted suggests the potential for highly sensitive technical information to be involved.

Organization profile and potential impact

Inet (Internet Thailand Public Company Limited) is a Thailand-based provider of data center, cloud computing, and managed services. The company offers infrastructure, network solutions, and digital transformation services to corporate clients.

This incident may lead to the exposure of sensitive data related to the organization's software development processes. The allegedly leaked data could contain source code, configuration files, or API keys, which may potentially compromise the organization's intellectual property. Furthermore, the organization might face legal consequences under Thailand's data protection regulations. Such a leak could also weaken the organization's supply chain security and potentially facilitate secondary attacks. Information about the fog group remains limited.

For organizations operating in the technology and managed services sector, maintaining robust security posture is critical. Common defensive steps include implementing strict access controls for development environments, utilizing multi-factor authentication, and conducting regular audits of API keys and configuration files. Protecting the software supply chain is essential to prevent secondary attacks that target the organization's customers through compromised code or infrastructure.