Kr3m listed on fog ransomware leak site

• Ransomware group: fog
• Country: Germany
• Sector: Technology
• Announcement date: March 6, 2025

The technology company Kr3m has been listed on the leak site of the fog ransomware group. According to an announcement made by the threat actor, the organization has been targeted in a cyberattack, resulting in a purported data breach.

The claims made by fog

The threat actor known as fog released a post on March 6, 2025, claiming that data belonging to Kr3m has been compromised. This announcement follows an alleged attack date of March 5, 2025. In the post, the group claims to have exfiltrated a significant amount of information from the organization. Rather than a standalone announcement, the threat actor has shared this data within a list alongside other organizations, a common tactic used by ransomware groups to demonstrate the scale of their operations.

Ransomware leak sites serve as a platform for threat actors to apply pressure on victims through a method often referred to as double extortion. In these scenarios, attackers do not only encrypt an organization's systems but also steal sensitive data, threatening to release it publicly if a ransom is not paid. By listing a victim on a public site, the group aims to damage the organization's reputation and create urgency through public exposure.

Data involved in the incident

The post indicates that a substantial volume of data is involved in this incident. The threat actor alleges that the information was obtained from the organization's GitLab infrastructure. This specific detail is significant as it points toward the potential exposure of technical assets.

• 58 GB of data allegedly obtained from the organization's GitLab infrastructure

The listing names no specific data types beyond the volume and the source of the exfiltration.

About Kr3m

Kr3m is a Germany-based technology company specializing in browser-based games and interactive digital content. They provide customized gaming solutions and advertising-focused interactive experiences for brands.

Potential implications and defensive considerations

This incident may pose risks to the organization's intellectual property and trade secrets. Because the data was allegedly exfiltrated from GitLab infrastructure, it may imply that source code and sensitive technical documentation could be exposed. Such an exposure could weaken the organization's supply chain security and potentially place it at a disadvantage against competitors.

Furthermore, as the organization operates in Germany, a potential data breach could lead to legal sanctions and notification obligations under the GDPR. Regulatory frameworks like the General Data Protection Regulation require organizations to maintain strict controls over personal data and report breaches within specific timeframes to avoid significant penalties.

For organizations operating in the technology sector, especially those managing digital content and interactive experiences, protecting development environments is critical. Common defensive steps for organizations include implementing robust access controls and multi-factor authentication for all infrastructure components, particularly code repositories like GitLab. Regularly auditing permissions, monitoring for unusual data exfiltration patterns, and ensuring that sensitive technical documentation is encrypted can help mitigate the impact of such attacks. While information about the fog group remains limited in the public domain, the nature of the claim suggests a focus on high-value technical infrastructure.