Messer Cutting Systems listed on Royal ransomware leak site

• Ransomware group: royal
• Country: United States
• Sector: Manufacturing
• Announcement date: February 2, 2023

Royal ransomware group claims breach of Messer Cutting Systems

The Royal ransomware group has listed Messer Cutting Systems on its leak site, claiming to have compromised the company's network. According to the threat actor, the breach involved a significant amount of stolen information. The group asserts that a total of 600 GB of data has been exfiltrated from the organization's systems. Furthermore, the attackers allege that a portion of this stolen data has already been made available for public access.

This type of activity is a hallmark of modern ransomware operations, often referred to as double extortion. In these scenarios, threat actors do not merely encrypt a victim's files to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak the data on a public leak site, the attackers aim to pressure the organization into paying a ransom to prevent the exposure of confidential information.

Details of the alleged data exfiltration

The information allegedly stolen by the Royal group is extensive and covers various aspects of the company's internal operations. The threat actor claims that the exfiltrated data includes sensitive personal information, human resources records, and various financial documents. Additionally, the breach reportedly involves project files, which could contain proprietary business information.

The claim specifies large volumes of specific data types, including:

• 37 GB of mailboxes
• 10 GB of SQL databases

Regarding the SQL databases, the group claims they contain sensitive details such as names, addresses, phone numbers, and email addresses belonging to employees, clients, and dealers. While the group has made these claims, no screenshots have been provided to verify the contents of the stolen data.

About Messer Cutting Systems

Messer Cutting Systems is a global supplier of cutting solutions and technologies for the metal-working industry. The company specializes in thermal cutting machines, software, and related services. Given its role in the manufacturing sector, the company provides essential technologies used in various industrial processes worldwide.

Risk assessment and industry implications

The nature of the alleged compromised data may increase the risk of identity theft and targeted phishing attacks for both employees and customers. Because the stolen information includes contact details and personal identifiers, individuals associated with the company may become targets for social engineering attempts. Furthermore, as a US-based entity, the company may face data breach notification obligations under relevant state laws and federal regulations.

The Royal group's reported origins are linked to Conti, suggesting that the group possesses the capability to employ sophisticated attack vectors. The publication of data on a leak site may negatively impact the company's operational continuity and commercial reputation, while potentially creating secondary risks for its supply chain. When a major supplier in the manufacturing sector is compromised, the ripple effects can extend to various partners and customers who rely on their technologies and services.

For organizations in the manufacturing sector, maintaining robust cybersecurity defenses is critical. This includes implementing strong access controls, conducting regular security audits, and ensuring that all software and systems are patched against known vulnerabilities. Additionally, organizations should have a well-defined incident response plan to manage the complexities of a data breach and mitigate potential impacts on reputation and supply chain integrity.