killsec ransomware group lists extramarks.com on its leak site

• Ransomware group: killsec
• Country: India
• Sector: Technology
• Announcement date: October 10, 2024

Killsec claims to have compromised extramarks.com

The threat actor known as killsec has published an announcement on its leak site, alleging that it has successfully compromised data belonging to the educational technology firm extramarks.com. According to the claim made by the group on October 10, 2024, the attackers have gained unauthorized access to the organization's digital infrastructure and have obtained various corporate documents.

This type of incident is often associated with double extortion tactics, a common strategy used by ransomware groups. In these scenarios, attackers do not only encrypt an organization's systems to demand a ransom for decryption but also steal sensitive information to threaten its public release. By publishing data on a leak site, the group aims to exert maximum pressure on the victim to meet their demands, using the threat of reputational damage and legal repercussions as leverage.

As part of the group's announcement, they have shared samples of invoices. These samples are said to contain information regarding the organization's operational processes, providing a glimpse into the types of internal documentation the group claims to have exfiltrated.

Details of the alleged data leak

The information allegedly stolen by killsec is described as including various administrative and financial records. The data is said to contain sensitive details that could impact the organization's internal operations and its relationships with external partners. Based on the group's claims, the affected data includes:

• Corporate identity numbers
• Tax identification numbers (PAN, GSTIN)
• Bank account details
• Authorized signatory contact information
• School addresses
• Course schedules

While the group has provided these details, it is important to note that the total size of the data and the exact number of files involved have not been disclosed by the threat actor. Furthermore, no specific ransom demand has been mentioned in the leak site announcement.

About extramarks.com

Extramarks is an India-based ed-tech company that provides digital education solutions for schools, teachers, students, and parents. The organization develops digital learning materials and management systems that are aligned with K-12 educational curricula, serving a wide range of stakeholders within the educational ecosystem.

Impact and potential risks

This alleged breach may increase the risk of identity theft and fraud for the organization's employees, partners, and the educational institutions it serves. The shared financial data could potentially serve as a basis for secondary attacks against the organization's supply chain, as attackers often use stolen corporate information to launch more targeted phishing or business email compromise campaigns against related entities.

Given the data protection regulations in India, the organization may face legal obligations in the event of such a data breach. Additionally, the hacktivist origins of the killsec group suggest that the motivation behind the attack may not be solely financial, but could also be aimed at causing reputational damage to the company.

In response to such incidents, organizations typically need to conduct a comprehensive forensic investigation to determine the full scope of the leaked data and identify the entry point used by the attackers. General defensive steps for organizations in the technology and education sectors often include implementing multi-factor authentication, maintaining strict access controls, and conducting regular security audits to protect sensitive student and corporate information.