Ningbo Joyson Electronic Corp. listed by Snatch ransomware group

• Ransomware group: Snatch
• Country: China
• Sector: Manufacturing
• Announcement date: July 18, 2023

The Snatch ransomware group has listed the automotive supplier Ningbo Joyson Electronic Corp. on its leak site. The threat actor claims to have successfully exfiltrated a massive volume of data from the organization, marking a significant alleged breach within the manufacturing sector.

The alleged attack and claims by Snatch

According to the announcement made on July 18, 2023, the Snatch group alleges that they have compromised the systems of Ningbo Joyson Electronic Corp. The group claims that the breach resulted in the exfiltration of approximately 20 TB of data. While the group has made these claims on their leak site, the incident remains an allegation by the threat actor.

The Snatch group is a known threat actor that has been active since 2018. This group is recognized in the cybersecurity landscape for its specific technical methodologies, particularly its technique of rebooting compromised systems into safe mode to facilitate the encryption process. Such tactics are often used by ransomware operators to bypass certain security software protections that are not active in safe mode, allowing the malware to operate more effectively during the encryption phase.

Details regarding the alleged leaked data

Regarding the specific contents of the alleged breach, the group has not provided any specific details regarding the content of the leaked data. However, based on the scale of the exfiltration, it is assessed that the 20 TB of data may contain various types of sensitive information, including:

• Corporate information
• Technical information
• Employee information

It is important to note that no specific file counts or ransom demands have been disclosed by the group in relation to this listing.

About Ningbo Joyson Electronic Corp.

Ningbo Joyson Electronic Corp. is an automotive supplier that develops and manufactures automotive safety and electronic systems for leading global automobile manufacturers. The company is deeply involved in the research and development of intelligent automotive technologies and new energy solutions, making it a significant player in the modern automotive supply chain.

Impact assessment and industry implications

This alleged breach may pose significant risks to the company's intellectual property and its operational continuity. Because Ningbo Joyson Electronic Corp. serves as an automotive supplier, the leakage of such a large volume of data could impact supply chain security and potentially facilitate secondary attacks against its third-party partners.

The publication of such data by the Snatch group could lead to reputational damage and the launch of targeted phishing campaigns against the organization or its stakeholders. Furthermore, due to the company's global operations, it is likely that legal processes under relevant data protection regulations may be triggered as a result of this incident.

In general, ransomware leak sites are used by threat actors to exert pressure on victims through a method known as double extortion. In this scenario, attackers not only encrypt the victim's data but also threaten to release sensitive information publicly to force a ransom payment. To defend against such threats, organizations typically implement robust backup strategies, maintain strict access controls, and conduct regular security monitoring to detect unauthorized exfiltration attempts.