level.game listed on Killsec ransomware leak site

• Ransomware group: Killsec
• Country: Russia
• Sector: Technology
• Announcement date: August 22, 2024

Killsec claims a data breach at level.game

The wellness technology company level.game has been listed on a ransomware leak site by the threat actor group known as Killsec. According to the announcement made on August 22, 2024, the group claims to have obtained a database dump belonging to the organization. This type of incident is characteristic of modern ransomware operations, where attackers use the threat of leaking sensitive information to pressure victims into paying a ransom.

The threat actor has stated that they are demanding a ransom of 25,000 USD from the organization. Furthermore, the group has issued a deadline, indicating that the payment must be made within 24 hours to prevent the publication of the stolen data. This tactic is a hallmark of double extortion, a method where attackers not only encrypt an organization's systems but also threaten to release sensitive data to maximize their leverage during negotiations.

Alleged data types involved in the leak

The announcement from the Killsec group claims that the compromised data is extensive and includes various types of sensitive information. The group asserts that the stolen data dump contains several categories of information that could be highly sensitive for both the organization and its users. According to the claim, the following data types are included in the breach:

• Full names
• Email addresses
• Passwords
• Device information
• IP addresses
• Geolocation data
• Payment details
• Operational data

The exposure of such a wide range of information, particularly including passwords and payment details, significantly increases the potential impact of the incident on the affected parties.

About level.game

Level SuperMind, operating under the domain level.game, is a wellness technology company. The company focuses on improving mental clarity and well-being through its mobile application. The app is designed to assist users in reducing stress and anxiety by offering various tools, including guided meditations, breathwork, sleep tools, and journaling exercises.

Analysis and potential implications

This alleged leak may pose significant risks of identity theft and financial fraud for users due to the exposure of personal and payment information. When sensitive details such as full names, email addresses, and payment information are leaked, individuals become prime targets for various forms of fraudulent activity. Furthermore, the exposure of passwords and device information could facilitate targeted phishing attacks against users' other accounts, as attackers often use leaked credentials to attempt unauthorized access to multiple services.

From a regulatory perspective, the organization's data processing practices may be subject to scrutiny under relevant data protection regulations following such an incident. Additionally, because the Killsec group has reportedly evolved into a ransomware-as-a-service provider and has hacktivist origins, such actions may negatively impact the organization's reputation. The shift of groups like Killsec into service-based models suggests that the possibility of further similar attacks within the industry should be considered.

In the technology sector, particularly for companies handling sensitive mental health and wellness data, maintaining robust security postures is critical. Organizations in this sector can take several defensive steps to mitigate risks, such as implementing multi-factor authentication to protect user accounts, conducting regular security audits, and ensuring strict adherence to data protection standards. Monitoring for leaked credentials on the dark web and enhancing encryption protocols for sensitive user data are also vital components of a comprehensive cybersecurity strategy.