Mpr Lifts listed on noescape leak site

• Ransomware group: noescape
• Country: Sweden
• Sector: Manufacturing
• Announcement date: November 13, 2023

The Swedish manufacturing company Mpr Lifts has been listed on the leak site of the threat group known as noescape. According to an announcement posted on November 13, 2023, the group claims to have successfully compromised the organization's network. This incident follows a claimed attack date of October 31, 2023, and involves a significant volume of data according to the threat actor's claims.

The details of the claimed attack

The noescape group has published an announcement regarding the incident, alleging that they have gained unauthorized access to the network of Mpr Lifts. The threat actor claims to have exfiltrated 162 GB of data from the company's servers. This type of activity is characteristic of modern ransomware tactics, often referred to as double extortion. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information to use as leverage.

The group has demanded that the company establish contact to negotiate the terms of the incident. The threat actor has issued a threat to release the stolen data publicly if their demands are not met. While the specific ransom demand has not been disclosed, the threat of public exposure serves as a primary method of pressure in these types of cyberattacks.

The sensitive data allegedly stolen

The announcement made by the noescape group claims that the exfiltrated data includes a wide variety of highly sensitive documents. The list of alleged stolen information includes:

• Financial documents
• Contracts
• Employee personal information
• Tax records
• Banking details
• Credit card information
• Passport details
• Audit reports
• Insurance documents

The breadth of this alleged data theft suggests a deep penetration into the organization's internal file systems, targeting both corporate and individual records.

About Mpr Lifts

Mpr Lifts is a leading elevator company operating across Sweden. The organization provides accessibility solutions for disabled individuals, offering elevator systems and adaptation services for both the private and public sectors.

Potential impact and organizational risks

This incident may pose significant risks of identity theft and fraud for both employees and customers due to the nature of the alleged data. Given the sensitive types of information claimed to be stolen, such as passport details, banking information, and credit card data, the company could face legal consequences under GDPR regulations. The exposure of such personal and financial data often leads to long-term complications for the individuals involved.

Furthermore, the company may experience operational disruptions and reputational damage as a result of the breach. There is also the potential for the leaked data to be utilized for targeted phishing campaigns, where attackers use specific, stolen details to craft highly convincing fraudulent communications to trick employees or clients.

While information regarding the noescape group remains limited, this incident highlights the ongoing risks faced by the manufacturing and service sectors. Organizations in this sector can take various defensive steps to mitigate such risks, such as implementing robust network segmentation, enforcing multi-factor authentication, and maintaining rigorous data encryption protocols. Regularly auditing access controls and ensuring comprehensive employee training on phishing awareness are also standard defensive measures used to protect against the types of exfiltration claimed in this incident.