Karadeniz Holding listed on fog ransomware leak site

• Ransomware group: fog
• Country: Türkiye
• Sector: Energy & Utilities
• Announcement date: February 3, 2025

Fog ransomware group claims data breach at Karadeniz Holding

The threat actor group known as fog has listed the Turkish organization Karadeniz Holding on its leak site. According to the announcement made on February 3, 2025, the group claims to have successfully exfiltrated a significant amount of data from the company's internal systems.

The threat actor claims to have obtained 1.5 TB of data from the organization. The post alleges that the stolen information includes various documents related to the company's internal operations. This type of announcement is a common tactic used in double extortion ransomware attacks, where attackers not only encrypt a victim's systems but also threaten to release sensitive information on public leak sites to pressure the organization into paying a ransom.

Details of the claimed data theft

The fog group's post specifies that the stolen files contain a wide range of sensitive information. While the accuracy and scope of the claimed data have not yet been verified by independent sources, the group alleges that the following types of data are included in the leak:

• Medical records
• Financial documents
• Customer contact information
• Corporate agreements
• Licenses
• Passport copies

The presence of such diverse data types, particularly highly sensitive personal information like medical records and passport copies, suggests a significant breach of both corporate and private data. In many ransomware scenarios, such leaks are used to maximize leverage over the victim by threatening to expose private details that could lead to legal or reputational consequences.

About Karadeniz Holding

Karadeniz Holding is a Turkish international company operating in the energy sector. The company is best known for the design, construction, and operation of floating power plants, also known as Powerships. It carries out various projects on a global scale within the field of energy generation and distribution.

Potential impact and security implications

This incident suggests that sensitive corporate and personal data within Karadeniz Holding may be at risk of exposure. The presence of passports and medical records could indicate that individuals might be exposed to secondary risks such as identity theft and fraud. Furthermore, the organization may be required to fulfill data breach notification obligations under the KVKK due to the nature of the alleged leak.

Information regarding the fog group is limited in the public domain. However, such leaks may create negative impacts on the organization's supply chain and operational security. In the energy and utilities sector, where operational technology and critical infrastructure are often integrated with corporate networks, the impact of a breach can extend beyond data loss to potential disruptions in service or supply chain trust.

Organizations facing similar threats often focus on defensive strategies such as implementing robust multi-factor authentication, maintaining offline backups, and conducting regular network segmentation to prevent lateral movement by attackers. Additionally, monitoring for unauthorized data exfiltration and ensuring strict access controls for sensitive files, such as those containing identity documents or financial records, are standard industry practices to mitigate the risks associated with ransomware and data theft.