Korea Petroleum Industries Company targeted by noescape ransomware group

• Ransomware group: noescape
• Country: United States
• Sector: Energy & Utilities
• Announcement date: October 23, 2023

Noescape group claims data breach at Korea Petroleum Industries Company

The threat actor group known as noescape has published a ransomware announcement targeting Korea Petroleum Industries Company. According to the claim posted on the group's leak site on October 23, 2023, the organization has been victimized in a cyberattack that has resulted in the alleged exposure of significant amounts of sensitive information.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The attackers then threaten to publish this stolen information on public leak sites if the victim fails to meet specific demands. This pressure tactic is designed to maximize the impact of the breach by leveraging the threat of reputational damage and regulatory scrutiny.

Details of the alleged attack and data theft

The noescape group alleges that they successfully compromised the network infrastructure of the organization. The group claims that the attack occurred on October 23, 2023, and that they have successfully exfiltrated approximately 71 GB of data. The threat actor has stated that they may proceed to release the full dataset if the organization does not establish contact with them.

The announcement claims that the stolen information includes over 50,000 scanned documents. The group alleges that these documents contain a wide variety of sensitive information, including:

• Patient personal information
• Client contact information
• Financial records
• Tax documents
• Bank account details
• Insurance information
• HR data
• Credit card information

The presence of such a vast amount of scanned documentation suggests a deep penetration into the organization's file servers or backup systems, which are common targets during the exfiltration phase of a ransomware operation.

About Korea Petroleum Industries Company

Korea Petroleum Industries Company is a South Korean energy and petrochemical company that produces and sells asphalt, solvents, and various construction materials. The company specializes in the production of blown asphalt and construction chemicals for industrial use.

Potential risks and implications of the incident

This incident may present significant risks due to the potential exposure of sensitive patient and customer data. The leakage of credit card and health insurance information could increase the risk of identity theft and fraud for affected individuals. As the organization is based in the US, the incident may lead to regulatory consequences under HIPAA and relevant state laws.

Furthermore, the exposure of such data can facilitate secondary attacks. For instance, stolen contact information and internal HR files can be used to craft highly convincing phishing emails, targeting employees or clients to gain further access to the network or to conduct social engineering attacks. There are also potential supply chain risks if the stolen data includes information regarding the company's partners or vendors.

While public information regarding the noescape group remains limited, the nature of this claim highlights the ongoing threat posed by ransomware groups to the energy and utility sectors. Organizations in this sector often manage critical infrastructure and vast amounts of sensitive industrial and personal data, making them high-value targets for cybercriminals. To defend against such threats, organizations typically implement multi-layered security strategies, including robust endpoint protection, regular offline backups, and strict access controls to minimize the impact of a potential breach.