Korea Petroleum Industrial Co. Ltd listed on noescape ransomware leak site

• Ransomware group: noescape
• Country: South Korea
• Sector: Energy & Utilities
• Announcement date: October 13, 2023

The ransomware group known as noescape has listed the South Korean company Korea Petroleum Industrial Co. Ltd on its leak site. According to the announcement made on October 13, 2023, the threat actor claims to have successfully compromised the organization's systems and stolen a significant volume of sensitive information.

The claims made by noescape

The threat actor, noescape, has announced that the servers belonging to Korea Petroleum Industrial Co. Ltd were both encrypted and compromised during the attack. The group claims that the breach occurred around October 5, 2023. In a classic example of double extortion, the group has stated that if the ransom is not paid, the stolen data will be published publicly on their leak site.

Beyond the threat of leaking data, the group has issued further threats against the organization. The attackers claim they will use the compromised email databases to launch spam campaigns. Furthermore, the group has threatened to conduct direct attacks against the company's clients, potentially expanding the scope of the incident from a single organizational breach to a broader supply chain threat.

The scope of the alleged data theft

The group claims to have exfiltrated approximately 145 GB of data, consisting of roughly 250,000 files. The announcement specifies that the stolen information is extensive and covers a wide range of business operations. According to the group, the data includes the following items:

• Financial data
• Contracts
• Import-export documents
• Email databases
• Business registration documents

The group further claims the stolen content includes confidential agreements, budget reports, tax information, payment and banking records, analysis certificates, project development files, and import-export documents dating from 2011 to 2023.

About Korea Petroleum Industrial Co. Ltd

Korea Petroleum Industrial Co., Ltd. is a company based in South Korea. The organization specializes in the production and sale of asphalt, solvents, and various other construction materials. Their expertise is focused specifically on industrial asphalt products and the manufacturing of construction chemicals.

Impact assessment and industry implications

This incident may negatively impact the company's operational continuity and commercial reputation. The exposure of financial and contractual documents could weaken the company's competitive advantage and pose significant risks to its existing relationships with third parties. Furthermore, the exposure of customer data may pave the way for supply chain attacks and targeted phishing attempts against the company's partners and clients.

From a regulatory perspective, it is likely that the company will face legal obligations under South Korean laws and relevant data protection regulations due to the nature of the compromised data. In the energy and utilities sector, such breaches can disrupt critical supply chains and erode trust among stakeholders.

While public information regarding the noescape group remains limited, this incident highlights the ongoing risks faced by industrial companies. Organizations in this sector often implement defensive measures such as robust backup strategies, network segmentation, and continuous monitoring to mitigate the impact of such attacks. Ransomware leak sites serve as a platform for attackers to exert pressure through public shaming and the threat of data exposure, making rapid incident response and data protection essential for modern industrial enterprises.