Instant Access listed on noescape leak site

• Ransomware group: noescape
• Country: Kuwait
• Sector: Technology
• Announcement date: October 23, 2023

Kuwait-based Instant Access targeted by noescape ransomware group

The ransomware group known as noescape has listed the Kuwait-based organization Instant Access on its leak site. According to the claims made by the threat actors, the organization has been targeted in a cyberattack that involves both the encryption of internal systems and the unauthorized acquisition of sensitive information.

Claims of network compromise and system encryption

The noescape group alleges that they have successfully compromised the network of Instant Access. The group claims to have encrypted the company's systems, a common tactic used in ransomware attacks to disrupt business operations and create urgency. Beyond the encryption of files, the attackers claim to have obtained a substantial amount of sensitive data from the organization's infrastructure. While the group has made these claims on their leak site, public information regarding the specific identity, methods, or background of the noescape group remains limited.

Details of the alleged data breach

The volume of data involved in this alleged breach is significant. The group claims to have exfiltrated approximately 71 GB of data, which reportedly consists of 50,000 files. Based on the samples provided by the attackers, the stolen information appears to include a variety of sensitive categories. The data types identified in the leak include:

• Patient personal data
• Insurance information
• Financial records
• Banking information
• HR data

The presence of such diverse data types suggests a broad compromise of the organization's digital environment, potentially affecting various departments ranging from human resources to finance and client management.

Organization profile

Instant Access is a Kuwait-based international company. The organization provides sales and rental services for quality construction-related equipment.

Analysis and potential impact of the incident

The nature of the allegedly leaked data poses significant risks to the organization, its customers, and its employees. The exposure of patient information, insurance details, and banking records creates a high risk for identity theft and financial fraud. For the organization, the publication of such sensitive information can lead to severe reputational damage and may increase risks for third-party supply chains that interact with the company.

Furthermore, given the specific region and the sector in which the organization operates, there may be potential non-compliance with data protection regulations. The use of double-extortion tactics—where attackers both encrypt data and threaten to leak it—is a method designed to maximize pressure on an organization to pay a ransom.

In such scenarios, organizations typically focus on defensive measures to mitigate the impact of such attacks. Common industry practices for responding to ransomware and data exfiltration include implementing robust backup strategies, enforcing multi-factor authentication across all access points, and maintaining strict network segmentation to prevent lateral movement by attackers. Additionally, continuous monitoring of network traffic and regular security awareness training for employees are fundamental components of a proactive defense posture against evolving ransomware threats.