Knight ransomware group claims data breach against Chamber of Deputies of Romania

• Ransomware group: Knight
• Country: Romania
• Sector: Government & Defense
• Announcement date: January 29, 2024

The threat actor known as Knight has claimed responsibility for a significant data breach targeting the Chamber of Deputies of Romania. According to an announcement made on a ransomware leak site on January 29, 2024, the group alleges to have successfully exfiltrated a substantial amount of sensitive information belonging to the Romanian legislative body.

Details of the alleged attack

On January 29, 2024, the Knight group posted an announcement claiming they had compromised the data of the Chamber of Deputies of Romania. The threat actor asserts that they are in possession of a dataset totaling approximately 250 GB. This massive collection of data is claimed to contain various sensitive documents, including contracts, information regarding employees, and various other files related to the deputies of the institution.

To support their claims and provide proof of the breach, the group has provided links to external platforms where a portion of the alleged stolen data can be accessed. While the group has made these claims, the specific details regarding the method of entry or the exact nature of the compromise remain unverified. In many such ransomware scenarios, threat actors utilize double extortion tactics, where they not only encrypt an organization's systems but also steal sensitive data to use as leverage for ransom demands during negotiations.

Alleged contents of the leaked data

The data allegedly stolen by the Knight group is reported to be highly sensitive, containing a wide array of personal and administrative information. The group claims that the leaked files include various types of records that could pose significant privacy risks if the information is indeed authentic. The specific types of data mentioned in the claim include:

• National ID information
• Salary details
• Expenditure reports
• Contracts
• Employee records

In addition to the list of data types, the group has provided a screenshot that displays a security verification screen encountered while attempting to access the leak site, which is a common occurrence on such platforms.

The Chamber of Deputies of Romania

The target of this alleged cyberattack is the Chamber of Deputies of Romania (Camera Deputaților din România). This institution serves as the lower house of the Parliament of Romania. As the country's legislative body, it is composed of members of parliament who are responsible for the creation and passage of laws.

Potential implications and organizational risks

This alleged breach could pose a significant data privacy risk to the Romanian legislative body. Because the leaked data reportedly involves public officials and deputies, the breach could lead to secondary risks, such as targeted phishing attacks and identity theft. When high-profile individuals are targeted, the potential for social engineering attacks increases, as attackers can use specific details from the stolen records to craft highly convincing fraudulent communications.

Given that the institution is a government body, such an incident may trigger legal and administrative processes under the European Union's General Data Protection Regulation (GDPR). Organizations within the government and defense sector often face heightened risks due to the sensitive nature of the data they handle, which can include national security information. While information regarding the Knight group remains limited, if these leaks targeting government institutions are verified, they could potentially have negative implications for national security.

To defend against such threats, organizations typically implement various defensive measures. These include robust network monitoring, multi-factor authentication, regular security audits, and comprehensive employee training to recognize phishing attempts. For government entities, maintaining strict adherence to data protection frameworks and ensuring rapid incident response capabilities are critical components of a modern cybersecurity posture.