Neodata listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: October 12, 2023

Medusa ransomware group targets Neodata

The Medusa ransomware group has listed the Spanish technology company Neodata on its dedicated leak site. According to the announcement made by the threat actors, the organization's data has been compromised. The group is utilizing a double extortion tactic, a common method in modern ransomware attacks where criminals not only encrypt an organization's systems but also steal sensitive information to use as leverage for extortion.

In this specific instance, the group claims that the company's data has been successfully exfiltrated. The threat actors have stated that the stolen information will be published on their leak site if the organization fails to meet their demands. This method is designed to maximize pressure on the victim by threatening the public exposure of proprietary and potentially sensitive information.

Details of the claimed extortion

The Medusa ransomware group has officially announced the attack against Neodata. Through their leak site, the group is claiming a ransom demand of 100,000 dollars from the organization. The announcement, which was posted on October 12, 2023, asserts that the company's data is currently in the hands of the attackers and is subject to release if the financial demands are not met.

The group has been known to be active since 2021 and manages its ransom negotiations and public shaming through its specific leak site. By listing the victim, the group aims to create public pressure and reputational damage to compel the target into paying the demanded amount.

Compromised data and evidence

The information provided by the attackers suggests that the breach involves various types of internal documentation. Based on the screenshots provided by the group, the stolen data includes documents related to the company's internal business processes and technical design documents. Additionally, the attackers have indicated that data in table format has been taken.

The specific types of affected data mentioned in the listing include:

• Business process documents
• Technical design documents

The presence of technical design documents and business process information suggests that the breach may carry a significant risk of exposing the company's trade secrets and operational data. Such information is often critical to the core functions of a technology firm.

Organization profile: Neodata

Neodata is a technology company based in Spain, with its headquarters located in Barcelona. The company specializes in the development of ERP software specifically tailored for the meat and poultry industry.

Risk assessment and industry implications

The targeting of Neodata presents several layers of risk. First, the potential exposure of trade secrets and operational data poses a direct threat to the company's competitive advantage. Furthermore, because the company operates within Spain, it is subject to the General Data Protection Regulation (GDPR). This means the organization may face significant administrative sanctions due to its data protection obligations if the breach involves personal data.

The use of the double extortion method by the Medusa group increases secondary risks, such as the possibility of the stolen data being sold on the dark web or leaked to various third parties. This creates a long-term security liability for the organization even if the initial ransom is addressed.

Moreover, there is a notable supply chain risk involved in this incident. Because Neodata develops ERP software used by other entities, the breach could create an indirect security risk for its customers. If attackers gain access to technical design documents or business processes, they may attempt to leverage that information to target the software's users.

Organizations in the software development and food production sectors should consider several defensive steps to mitigate such risks. Implementing robust data loss prevention (DLP) tools, maintaining strict access controls, and conducting regular security audits of the software development lifecycle are critical. Additionally, companies should ensure they have a comprehensive incident response plan and a clear understanding of their GDPR compliance requirements to manage the fallout of a potential data exfiltration event.