killsec ransomware group lists pbgbank.com on its leak site

• Ransomware group: killsec
• Country: India
• Sector: Financial Services
• Announcement date: March 21, 2024

Killsec claims a breach of Paschim Banga Gramin Bank

The threat actor known as killsec has published an announcement on their leak site claiming to have breached pbgbank.com. According to the group's claims, the incident involves a data leak targeting the financial institution. The group has stated that they are demanding a ransom of 10,000 EUR from the organization to prevent the release of the stolen information.

This incident follows a pattern often seen in modern cyberattacks where threat actors utilize leak sites to pressure victims. In these scenarios, the attackers claim to have exfiltrated sensitive information and threaten to publish it if their financial demands are not met. This tactic is a hallmark of double extortion, a method where attackers not only encrypt a victim's systems but also steal data to use as leverage for extortion.

The scope of the alleged data theft

The announcement made by killsec suggests that a variety of sensitive files were obtained during the alleged attack. The group claims that the stolen information includes various types of internal and operational documentation. The specific types of data mentioned in the leak site announcement include:

• Internal corporate correspondence
• Operational documents
• Employee seniority lists
• Training materials

The group further claims that the stolen data contains bank branch information, chairman desk records, e-learning materials, colleague lists, business dashboard data, policies, and seniority lists. The inclusion of such diverse datasets suggests a broad reach into the organization's internal digital environment.

About Paschim Banga Gramin Bank

Paschim Banga Gramin Bank is a regional rural bank that operates within the West Bengal state of India. The institution provides essential banking services to rural areas, focusing on supporting the local population. Its primary mission involves offering retail and agricultural banking products to facilitate financial growth and stability in these regions.

Risks and implications of the alleged breach

This alleged breach may pose significant operational and reputational risks to the institution due to the exposure of sensitive data within the banking sector. The publication of employee lists and internal policies could facilitate targeted phishing attacks against the institution's staff. When personal or professional details of employees are leaked, it provides attackers with the necessary context to craft highly convincing social engineering campaigns.

Furthermore, the institution may face legal sanctions under Indian data protection regulations following the exposure of this information. The killsec group, which emerged in 2023, is reported to have hacktivist origins. This suggests that the attack may involve ideological motivations in addition to financial gain. The use of double extortion tactics may increase the secondary risks associated with the leaked data, as the information remains a liability even if systems are restored from backups.

For organizations in the financial sector, such incidents underscore the importance of robust defensive measures. Common defensive steps include implementing multi-factor authentication, maintaining strict network segmentation to prevent lateral movement, and conducting regular security awareness training for staff to mitigate phishing risks. Additionally, maintaining comprehensive, offline backups and a well-tested incident response plan are critical components of a resilient cybersecurity posture.