JOHN A BODZIAK ARCHITECT AIA targeted by ALPHV ransomware group

• Ransomware group: ALPHV
• Country: United States
• Sector: Professional Services
• Announcement date: July 26, 2023

The ALPHV ransomware group has listed a significant amount of data on its leak site, claiming the information belongs to the architectural firm JOHN A BODZIAK ARCHITECT AIA. According to the announcement made on July 26, 2023, the threat actor group claims to have exfiltrated a substantial volume of sensitive information from the organization.

The claimed attack and data exfiltration

The ALPHV group created a leak announcement on July 26, 2022, claiming to have compromised data belonging to JOHN A BODZIAK ARCHITECT AIA. The group states that a total of 290 GB of data was obtained from the organization's file servers. This type of activity is characteristic of modern ransomware operations, often employing a "double extortion" tactic where attackers not only encrypt a victim's systems but also steal sensitive data to pressure the organization into paying a ransom by threatening to leak the information publicly.

The announcement includes claims regarding the exposure of the organization's network map and various sensitive documents. The disclosure of a network map is particularly critical as it provides a blueprint of the internal infrastructure, which can be exploited by attackers to facilitate further movement or subsequent attacks.

Details of the exposed information

The leak announcement includes a wide variety of sensitive materials. The group claims to have obtained internal correspondence, insurance documents, agreements, construction drawings, client identification documents, social security numbers (SSN), technical documentation, and network credentials. Furthermore, screenshots provided by the group display examples of passports, credit card authorization forms, and professional license documents.

The specific types of data identified in the listing include:

• Client identification documents
• Social security numbers (SSN)
• Construction drawings
• Agreements
• Insurance documents
• Network credentials
• Credit card information

Organization profile

John A. Bodziak Architect AIA is an architectural firm providing architectural design, engineering, and technical consulting services for residential and commercial projects in the St. Petersburg region.

Analysis and potential consequences

This breach may increase the risk of identity theft and financial fraud for the organization's employees and clients. Given that the organization is based in the US, the exposure of personal data may lead to legal consequences under state-level data protection laws and regulations. The disclosure of the network map and credentials could create a foundation for future targeted phishing attacks.

The variety of exposed documents suggests that the organization's operational security may have been significantly compromised. The ALPHV (BlackCat) group, which is the entity behind this claim, is characterized as a Ransomware-as-a-Service (RaaS) operation developed in Rust, known for its activities until 2024.

For organizations in the professional services sector, such incidents highlight the importance of robust defensive measures. Common defensive steps include implementing multi-factor authentication (MFA) to protect credentials, maintaining strict network segmentation to prevent lateral movement, and conducting regular backups that are stored offline or in immutable environments. Additionally, continuous monitoring of network traffic and employee training to recognize phishing attempts are essential components of a modern cybersecurity posture to mitigate the risks posed by sophisticated RaaS groups.