Leal Group listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Mauritius
• Sector: Professional Services
• Announcement date: July 26, 2023

Mauritius-based Leal Group targeted by ALPHV ransomware group

The ALPHV ransomware group has listed the Mauritius-based Leal Group on its leak site, claiming to have successfully exfiltrated sensitive data from the organization. This announcement, made on July 26, 2023, follows a claimed attack date of February 14, 2023. While the group has published a listing, specific details regarding the total volume of stolen data, the exact number of files compromised, and the specific ransom demand have not been provided by the threat actors.

Details of the alleged breach

The ALPHV (also known as BlackCat) group published a leak announcement regarding Leal Group, alleging that they gained unauthorized access to the company's networks. According to the group's claims, this access allowed them to obtain various sensitive datasets belonging to the institution. To support their claims, the group has provided screenshots that appear to contain samples of the organization's operational and personal data.

The contents of these screenshots suggest a significant breach of privacy, as they reportedly include a variety of sensitive documents. The types of data identified in the leaked samples include:

• Employee personal data
• Passport information
• Driver's licenses
• Tax records
• Customer financial data
• Network credentials

The presence of such diverse information, ranging from identification documents to financial and network-related data, highlights the potential impact of the alleged intrusion on the organization's internal operations and its relationship with clients and employees.

About Leal Group

Leal Group is a well-established holding company based in Mauritius. The organization maintains a broad operational footprint, working across several diverse sectors including automotive, medical, consumer goods, information technology, engineering, and tourism. Having been active for over nine decades, the group has been a significant contributor to the economic development of Mauritius.

Risk assessment and industry implications

The alleged leak of such sensitive information poses a substantial risk to both employees and customers, specifically increasing the potential for identity theft. The inclusion of highly sensitive documents, such as passports and tax records, suggests that there may have been vulnerabilities within the organization's data protection processes. Because Leal Group is a Mauritius-based entity, the incident may involve potential violations of local data protection laws, and depending on the scope of their operations, it could also involve international regulations such as the General Data Protection Regulation (GDPR).

The ALPHV group is a known Ransomware-as-a-Service (RaaS) operator. Historically, the group has utilized Rust-based ransomware, a development that remained consistent until early 2024. The involvement of a sophisticated RaaS operator suggests that the exfiltrated data could potentially be leveraged in secondary attacks or targeted phishing campaigns against the organization or its stakeholders.

In the broader context of cyber threats, ransomware attacks often employ a