noescape ransomware group lists Grupo SCA - Business Information on its leak site

• Ransomware group: noescape
• Country: Spain
• Sector: Professional Services
• Announcement date: August 2, 2023

Noescape claims data breach at Grupo SCA

The ransomware group known as noescape has listed a significant amount of data allegedly belonging to the Spanish professional services firm Grupo SCA on its dedicated leak site. According to the announcement, which appeared on the group's platform, the threat actors claim to have successfully compromised the organization's networks and exfiltrated a substantial volume of information.

The incident involves a classic double extortion tactic, a method frequently employed by modern ransomware groups. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to publish the stolen information publicly, the attackers aim to pressure the organization into meeting their demands to prevent the exposure of confidential records.

Details of the alleged attack

The threat actor known as noescape claims to have compromised the networks of Grupo SCA and encrypted their servers. The group states that they have exfiltrated 205 GB of data and threatens to publish the information if the company does not engage in negotiations. This announcement was listed on the group's leak site on July 25, 2023, though the listing was officially noted on August 2, 2023.

The group's threat to leak the data to competitors poses an additional risk to corporate competitiveness. While public information regarding the noescape group remains limited, their tactics highlight the growing trend of targeting professional service providers to maximize the impact of their extortion attempts.

Alleged data types involved in the leak

The data allegedly stolen by the noescape group is diverse and includes highly sensitive corporate and personal information. The claimed exfiltration includes a wide range of files that could compromise the privacy of clients and the integrity of the company's internal operations. The alleged data includes:

• MySQL databases
• Backups
• Contracts
• Confidential documents
• Client data
• Non-disclosure agreements (NDA)
• Tax documents
• Financial and banking records

About Grupo SCA

Grupo SCA is a Spain-based consulting company that has been operating for over twenty years, providing strategic solutions and consulting services. The company offers professional support for corporate processes, leveraging the expertise of its management team gained from multinational firms.

Potential impact and organizational risks

The alleged breach may negatively impact the company's operational continuity and client trust. Given the company is based in Spain, the leaked data likely falls under GDPR regulations, potentially leading to legal sanctions for the organization. The exposure of client and financial information could lead to secondary risks such as identity theft and targeted phishing attacks.

For organizations operating in the professional services sector, such incidents underscore the critical importance of robust cybersecurity frameworks. Protecting sensitive client data and maintaining operational continuity requires a multi-layered defense strategy. Common defensive steps for organizations include implementing strict access controls, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.