LUA Coffee targeted by fog ransomware group

• Ransomware group: fog
• Country: Indonesia
• Sector: Retail & E-Commerce
• Announcement date: February 4, 2025

The fog group claims a data breach at LUA Coffee

The threat group known as fog has published data allegedly belonging to LUA Coffee on its leak site. According to an announcement made on February 4, 2025, the group claims to have targeted the Indonesian organization. The group asserts that the breach occurred around February 1, 2025.

In the context of modern cybercrime, ransomware groups often utilize a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. While the ransom demand for this specific incident has not been disclosed, the publication of data on a leak site is a hallmark of this extortion strategy.

The group's announcement suggests a specific method of acquisition. The fog group claims that the data was extracted from a GitLab repository. This highlights a growing trend where attackers target development environments and version control systems to access intellectual property and sensitive configuration details.

Details of the alleged data leak

The announcement made by the fog group claims that a significant amount of information has been compromised. Specifically, the group claims that 5 GB of data has been leaked. This data is said to consist of GitLab source code and related information belonging to LUA Coffee.

The leak appears to have broader implications than just the primary target. The announcement mentions that data belonging to other entities is also included in the leak. These organizations are identified as:

• PT. ITPRENEUR INDONESIA TECHNOLOGY
• GFZ Helmholtz Centre for Geosciences

The inclusion of these additional entities suggests that the breach may involve interconnected systems or shared digital resources. This possibility introduces potential supply chain risks, where a compromise in one organization can lead to the exposure of data belonging to its partners or clients.

Affected data types

The listing identifies the following as the primary type of affected data:

• Source code

About LUA Coffee

LUA Coffee is an Indonesia-based coffee chain and retailer. The company provides various coffee products and cafe services.

Analysis and potential implications

The alleged leak of source code may expose security vulnerabilities within LUA Coffee's digital infrastructure. When source code is made public, it can provide a roadmap for malicious actors to identify flaws in the software's logic or configuration. This exposure could potentially serve as a foundation for more complex cyberattacks in the future, such as targeted exploits or further unauthorized access.

Furthermore, the publication of such data could harm the organization's intellectual property. For a retail and service-oriented company, the loss of proprietary code or operational data can have significant business impacts. From a regulatory perspective, the organization may face legal obligations under Indonesian data protection regulations due to the nature of the alleged breach.

The presence of other organizations' data in the leak highlights the necessity for organizations to monitor their supply chain security. In a modern digital ecosystem, companies are often linked through shared services and third-party platforms. A vulnerability in one link of the chain can jeopardize the entire network. Organizations in the retail and e-commerce sectors can take several defensive steps to mitigate such risks, including implementing strict access controls on code repositories, employing multi-factor authentication, and conducting regular audits of third-party integrations.

Information regarding the fog group remains limited in the public domain, making it difficult to attribute the attack or understand the full scope of the group's capabilities. As with all reported leaks, the information provided by the threat actor remains a claim and has not been independently verified.