Markas listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Austria
• Sector: Professional Services
• Announcement date: July 26, 2023

ALPHV claims data breach at Markas

The ALPHV (BlackCat) ransomware group has listed the Austrian organization Markas on its dedicated leak site. According to the group's announcement, they claim to have successfully exfiltrated data belonging to the company, marking a significant targeted incident against the professional services provider.

Ransomware attacks of this nature often involve a tactic known as double extortion. In such scenarios, threat actors do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information before the encryption phase. The attackers then use the threat of leaking this stolen data on public forums to pressure the organization into paying a ransom. This method increases the leverage of the cybercriminals, as the victim faces not only operational downtime but also potential regulatory scrutiny and reputational damage.

Details of the alleged attack

The ALPHV group claims to have gained unauthorized access to the networks of Markas. Following the initial breach, the group states that they conducted an extensive study of the organization's business operations to identify valuable assets. The group asserts that they exfiltrated confidential data prior to the attack and has threatened to publish this information publicly if their specific demands are not met.

The announcement regarding this incident was posted on the group's leak site on February 21, 2023. It is important to note that the group's claims regarding the breach and the subsequent theft of information have not been independently verified. The group's activity in this instance follows a pattern of targeting various sectors to maximize their extortion potential.

Information regarding the stolen data

Based on the information provided by the threat actors, the volume of the data allegedly taken from the organization is substantial. The group has provided a screenshot indicating the scale of the breach, though many specifics remain unknown.

• The total size of the allegedly exfiltrated data is 104 GB.

While the volume of the data is specified, the listing does not provide any specific details regarding the types of data contained in the leak. No information has been provided regarding the exact file count or the specific nature of the documents stolen.

About Markas

Markas is an Austria-based company that has been in operation since 1985. The organization provides a wide range of professional services, including cleaning, catering, logistics, and facility management. They focus on offering tailor-made and innovative facility management solutions to their diverse client base.

Risk assessment and industry implications

This alleged data breach may pose significant risks to the organization's operational continuity and corporate reputation. Because the 104 GB dataset may contain sensitive employee or client information, the incident could potentially trigger legal obligations under data protection regulations such as the General Data Protection Regulation (GDPR).

Given the professional services sector in which Markas operates, the incident may lead to secondary risks, particularly in the form of targeted phishing attacks. When attackers possess large datasets, they often use the stolen information to craft highly convincing social engineering campaigns against the organization's employees or its clients.

ALPHV, also known as BlackCat, is recognized as a Rust-based Ransomware-as-a-Service (RaaS) group that emerged in late 2021. It has been reported that the group ceased its operations as of March 2024. Organizations operating in professional services can mitigate such risks by implementing robust network segmentation, maintaining rigorous access controls, and conducting regular security awareness training to defend against the phishing attempts that often follow a data leak.