Informa.com listed on Clop ransomware leak site

• Ransomware group: Clop
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: July 26, 2023

Clop claims data breach against Informa.com

The threat actor known as Clop has listed the organization Informa.com on its dedicated leak site. This announcement, made on July 26, 2023, includes an allegation that the group has successfully obtained access to the organization's data. The claim is supported by a provided screenshot showing the verification screen of the group's leak site, which serves as the group's method of demonstrating its ability to compromise targets.

Ransomware leak sites are a central component of modern cyber extortion strategies. In these scenarios, threat actors often employ a method known as double extortion. In a double extortion scheme, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The attackers then threaten to publish this stolen data on their public leak sites if the ransom is not paid. This tactic increases the pressure on the victim by threatening their reputation and the privacy of their stakeholders.

Details of the alleged incident

The event was officially announced on the group's platform on July 26, 2023. While the group claims to have gained access to the organization's data, they have not provided specific details regarding the nature of the stolen information. Furthermore, no sample files have been released by the group to substantiate their claims at this time. The listing currently lacks any information regarding the volume of data taken or the specific files involved.

The listing names no specific data types that have been compromised.

Organizational profile

Informa.com is identified as a major player in the professional services sector. Specifically, Informa PLC is an international company specializing in events, digital services, and academic publishing. The organization provides a wide range of exhibitions, conferences, and information services to various industries on a global scale.

Analysis and potential implications

When evaluating this incident, it is important to consider the historical patterns of the Clop group. Based on their past activities, it is possible that this incident may be related to the exploitation of vulnerabilities within file transfer software. Such vulnerabilities often serve as entry points for sophisticated threat actors to move through a network and locate sensitive assets.

The association of this group with TA505 suggests that this incident may be part of a broader, large-scale campaign. Large-scale campaigns often target multiple organizations across different sectors to maximize the impact and the potential for ransom payments. For an organization operating in the professional services sector, the risks associated with a data breach are significant. There is a potential risk that the compromised data could include sensitive commercial or operational information essential to the company's functions.

The publication of such data can lead to various secondary risks for the organization's clients and employees. These risks include the possibility of identity theft or the execution of targeted phishing attacks, where attackers use stolen information to craft highly convincing fraudulent communications. Such attacks are often used to gain further access to systems or to trick individuals into revealing more sensitive credentials.

Defensive considerations for the sector

Organizations operating in the professional services and information sectors can take several steps to mitigate the risks posed by such threats. Maintaining a robust patch management program is critical, particularly for internet-facing software such as file transfer protocols, to prevent the exploitation of known vulnerabilities. Additionally, implementing strict access controls and monitoring for unusual data exfiltration patterns can help detect an intrusion before data is successfully moved out of the network.

Furthermore, because these attacks often target sensitive commercial data, organizations should prioritize the encryption of data both at rest and in transit. This ensures that even if data is exfiltrated, it remains unreadable to the attackers. Finally, because secondary risks like phishing are common following a breach, continuous security awareness training for employees and clients remains a vital component of a comprehensive defense strategy.