Maze ransomware group lists BST & CO (accounting firm) on its leak site

• Ransomware group: Maze
• Country: United States
• Sector: Financial Services
• Announcement date: December 4, 2019

The Maze ransomware group has listed the United States-based accounting firm BST & CO on its leak site. According to the announcement made by the threat actors, the organization has been targeted in a data breach involving the exfiltration of sensitive information.

The claims made by the Maze group

On December 4, 2019, the Maze group published a post claiming that data belonging to BST & CO has been exfiltrated. The threat actors allege that they successfully gained access to the organization's network and subsequently copied sensitive information from the environment. While the group has made these claims, public information regarding the specific tactics, techniques, and procedures used by this group remains limited.

Ransomware attacks involving leak sites often utilize a method known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also steal sensitive data before the encryption process begins. The stolen information is then used as leverage, where the attackers threaten to publish the data on a public leak site unless a ransom is paid. This tactic increases the pressure on the victim, as the threat of a data leak can cause significant reputational and legal damage even if the organization can restore its systems from backups.

Information regarding the alleged leaked data

At this time, no information regarding the nature or content of the allegedly leaked data has been provided by the attackers. Furthermore, there is no screenshot available to verify the contents of the stolen files. The listing names no specific data types.

Organization profile

BST & CO is an accounting firm operating within the United States. The organization functions within the financial services sector, a high-value target for cybercriminals due to the sensitive nature of the information handled by such entities.

Potential impact and sector implications

Given that the organization operates in the financial services sector, the potential breach may pose risks to the confidentiality of client data. The disclosure of the alleged data could lead to secondary risks such as identity theft and fraud for the affected clients. Additionally, the organization may experience reputational damage and disruptions to its operational processes.

Furthermore, the organization may face legal obligations under state-level data protection laws and sectoral regulations in the US. When organizations in the financial services sector face such incidents, they must navigate complex regulatory landscapes to ensure compliance with reporting requirements and data protection standards.

To defend against such threats, organizations typically implement various security measures. These include robust network monitoring to detect unauthorized access, strict access controls to limit the movement of attackers within a network, and comprehensive encryption for data both at rest and in transit. Regular security audits and employee training are also common defensive steps used to mitigate the risk of initial access and subsequent data exfiltration.