Mitsubishi Chemical Group listed by Everest ransomware group

• Ransomware group: Everest
• Country: Japan
• Sector: Manufacturing
• Announcement date: August 31, 2024

Everest ransomware group claims data breach at Mitsubishi Chemical Group

The Everest ransomware group has officially listed the Japanese multinational Mitsubishi Chemical Group on its leak site. According to the announcement made on August 31, 2024, the threat actor claims to have successfully accessed the company's internal data. The group alleges that the organization has remained indifferent to the situation, prompting the attackers to move forward with their extortion tactics.

This incident follows a pattern common in modern cyber extortion, where threat actors target high-value corporate entities to maximize leverage. By listing a victim on a public leak site, ransomware groups aim to exert maximum pressure on the target organization to fulfill their demands. In this specific case, the Everest group has demanded a ransom payment of 3,000,000 USD to prevent further exposure or to facilitate the return of data.

Details of the alleged attack and ransom demand

The claim of the attack was made on August 31, 2024, the same day the organization was listed on the leak site. The Everest group asserts that they have exfiltrated a massive amount of information, specifically claiming a total data size of 6 terabytes. To demonstrate the legitimacy of their breach, the group has shared various document samples as part of their announcement.

The group's strategy in this instance appears to align with a double extortion model. In such scenarios, attackers do not merely encrypt a company's systems to disrupt operations; they also steal sensitive information to use as leverage. If the victim refuses to pay the ransom, the attackers threaten to leak the stolen data publicly, causing significant reputational, legal, and operational damage. This dual-threat approach increases the likelihood of a payout by targeting the organization's fear of public exposure.

Alleged stolen data types

The data purportedly stolen by the Everest group includes a wide variety of sensitive corporate and technical information. Based on the samples and descriptions provided in the announcement, the stolen content includes:

• Technical drawings
• Development projects
• Contracts
• Internal incident reports
• Safety reports

Furthermore, the group has provided screenshots that allegedly contain confidential information control lists, process safety incident reports, and matrices related to personal protective equipment (PPE) for laboratory activities. The breadth of this data suggests a deep penetration into the company's operational and technical documentation.

About Mitsubishi Chemical Group

Mitsubishi Chemical Group is a Japan-based multinational chemical company. The organization operates across several critical fields, including chemical products, performance materials, and healthcare solutions. Due to its diverse operations, the company provides a wide range of products for various essential industries, such as automotive, electronics, food, and pharmaceuticals.

Risk assessment and industry implications

The Everest group is a Russian-speaking threat actor that has been active since 2020. They are known for their specialized focus on data exfiltration, extortion, and the sale of unauthorized access to other criminals. The alleged theft of 6 TB of data poses significant risks to Mitsubishi Chemical Group, particularly regarding their intellectual property and overall operational security. The loss of technical drawings and development projects could result in the loss of competitive advantages in the global market.

Because Mitsubishi Chemical Group is a Japan-based entity, this potential breach may trigger specific legal obligations under Japan's Act on the Protection of Personal Information (APPI). Organizations facing such incidents must navigate complex regulatory landscapes to ensure compliance with data protection laws. Additionally, the breach creates secondary risks for the company's supply chain partners and employees, who may become targets for subsequent phishing attacks or identity theft as their information becomes available to malicious actors.

For organizations operating in the manufacturing and chemical sectors, such incidents highlight the necessity of robust cybersecurity frameworks. Defensive measures typically include implementing strict access controls, maintaining comprehensive logging to detect unauthorized movement, and conducting regular audits of sensitive technical documentation. Protecting the integrity of intellectual property and ensuring the security of laboratory and safety protocols remains a critical priority for multinational industrial corporations.