National Institute of Administration targeted by killsec ransomware group

• Ransomware group: killsec
• Country: Romania
• Sector: Education
• Announcement date: November 11, 2024

Killsec claims data breach at National Institute of Administration

The threat actor known as killsec has posted an announcement on its leak site claiming to have targeted the National Institute of Administration. According to the group, they have successfully accessed systems belonging to the Romanian institution and have made the allegedly obtained data available for download on their platform. This announcement was added to the group's system on November 11, 2024.

Ransomware attacks often involve a tactic known as double extortion, where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to release this data on a public leak site, threat actors aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. This method is particularly effective against public institutions where data privacy and public trust are paramount.

Details of the alleged data theft

The announcement made by killsec specifies that the stolen information contains a variety of sensitive data types. The group claims that the breach involves personally identifiable information (PII) that could be used for malicious purposes. The specific categories of data mentioned in the claim include:

• Names
• Personal identification numbers (CNP)
• Email addresses
• Phone numbers
• Financial data
• User account credentials

Beyond the personal identifiers, the group alleges that the breach includes financial details regarding payments and tariffs. Furthermore, the claim suggests that confidential business information related to training programs was compromised. The leaked dataset is also said to contain user account credentials linked to both personal and institutional email addresses, potentially providing a gateway for further unauthorized access or identity impersonation.

About the National Institute of Administration

The National Institute of Administration is a government institution located in Romania, operating under the Romanian Ministry of Internal Affairs. The organization specializes in the training and professional development of civil servants. Its primary mission is to increase administrative capacity within the government by organizing various training programs specifically designed for the field of public administration.

Potential impact and organizational risks

The alleged leak of this data poses significant secondary risks. For the staff members of the institute and the individuals participating in training programs, the exposure of names, phone numbers, and CNPs could lead to identity theft and highly targeted phishing attacks. Such attacks often exploit the trust established through legitimate-looking communications to deceive individuals into revealing even more sensitive information or transferring funds.

Because the National Institute of Administration is a public institution operating within Romania, this incident may lead to legal consequences under the European Union's General Data Protection Regulation (GDPR), which mandates strict protections for personal data. Additionally, the organization may face operational disruptions in its administrative processes and potential negative impacts on the perceived reliability of public services.

The killsec group, which emerged in 2023, is reported to have had hacktivist origins before transitioning into a ransomware-as-a-service model. This evolution suggests that the group may conduct such leaks to exert pressure on institutions or to cause significant reputational damage in the public eye. To mitigate such risks, organizations in the public sector typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular security awareness training to defend against the social engineering tactics that often follow a data breach.