JspPharma listed on insane ransomware leak site

• Ransomware group: insane
• Country: Thailand
• Sector: Healthcare
• Announcement date: January 17, 2024

A new data breach claim against JspPharma

The threat actor known as insane has listed the Thailand-based pharmaceutical manufacturer JspPharma on its leak site. The announcement, which appeared on January 17, 2024, claims that the group has successfully exfiltrated sensitive information belonging to the organization. This development follows a pattern often seen in modern cyberattacks, where threat actors use public leak sites to pressure victims into paying ransoms by threatening to release stolen data.

In many such incidents, ransomware groups employ a strategy known as double extortion. In this scenario, the attackers do not merely encrypt a company's systems to disrupt operations; they also steal sensitive data beforehand. If the victim refuses to pay the ransom to restore their systems, the attackers threaten to publish the stolen information on a public leak site, causing significant reputational and legal damage. This method increases the leverage held by the threat actor during negotiations.

Details of the alleged attack

According to the claims made by the insane group, the data breach occurred on January 17, 2024. The group asserts that the stolen information includes documents related to the company's research and development processes, as well as various types of personal information. To demonstrate the validity of their claims, the threat actor stated that they have provided sample files to the victim.

The group has reportedly initiated a negotiation process with the organization. While the specific ransom demand remains unknown, the presence of a negotiation phase indicates that the attackers are actively attempting to extract payment in exchange for not releasing the full dataset to the public. The group's public profile and specific details regarding their operations remain limited.

Alleged data types involved in the leak

Based on screenshots provided by the threat actor, the data allegedly leaked contains a wide variety of sensitive information. This includes both corporate assets and highly sensitive personal details of individuals associated with the company. The items identified in the claim include:

• Names
• Phone numbers
• Email addresses
• Bank card details
• Corporate documents
• Agreements
• Research and development (R&D) records

The inclusion of such diverse data types suggests a significant breach of both operational and personal information. The presence of financial and contact information can lead to various secondary risks for the individuals involved, such as identity theft or financial fraud.

About JspPharma

JSP Pharmaceutical Manufacturing (Thailand) PCL is a company based in Thailand. The organization is engaged in the research, development, and production of various medical and wellness products. Their portfolio includes drugs, dietary supplements, cosmetics, and herbal products. The company operates under a dual business model, manufacturing and distributing products under its own brand, while also producing items under various customer brand names.

Implications and defensive considerations

This incident suggests that the personal data of JspPharma's employees and customers may be at risk of exposure. The alleged leakage of research and development data is particularly concerning, as it may lead to negative consequences regarding intellectual property rights and could weaken the company's competitive advantage in the pharmaceutical market. Furthermore, the company may face legal sanctions under the data protection regulations applicable in Thailand.

For organizations operating within the healthcare and pharmaceutical sectors, such incidents highlight the critical importance of robust cybersecurity frameworks. Protecting intellectual property and sensitive personal data is vital to maintaining competitive advantage and regulatory compliance. Organizations in this sector typically focus on implementing multi-layered defense strategies, including strict access controls, regular security audits, and comprehensive data encryption to mitigate the risk of exfiltration. Additionally, maintaining a clear incident response plan is essential for managing the fallout of a potential breach and navigating the legal requirements of regional data protection laws.