Nokoyawa ransomware group claims data breach against comcom-sgc

• Ransomware group: Nokoyawa
• Country: France
• Sector: Government & Defense
• Announcement date: May 23, 2023

Nokoyawa ransomware group claims data breach against comcom-sgc

The Nokoyawa ransomware group has published a leak announcement on its dedicated leak site, claiming to have obtained a significant amount of data belonging to the organization comcom-sgc. According to the group's claims, approximately 150 GB of data has been released following an intrusion into the organization's digital infrastructure.

Details of the alleged intrusion

The announcement made by the Nokoyawa group suggests that the breach occurred following unauthorized activity that took place around April 9, 2023. The group claims to have successfully gained access to the digital infrastructure of comcom-sgc, allowing them to extract and subsequently publish the files on their leak site on May 23, 2023.

In modern cyberattack scenarios, such as the double extortion tactics often employed by ransomware groups, attackers typically steal sensitive information before encrypting systems. This provides the threat actor with leverage, as they can threaten to release the stolen data on public leak sites if the victim refuses to meet their demands. While the specific ransom demand for this incident was not mentioned in the announcement, the publication of data is a hallmark of this extortion strategy.

Scope of the claimed data theft

The information released by the Nokoyawa group is said to include various types of sensitive documentation and media files. The group claims that the stolen data contains information related to the residents of the region, as well as various technical and visual assets. The specific categories of data mentioned in the announcement include:

• Resident data
• Topographic images
• Cadastral maps
• Photo-video footage

The presence of such diverse data types—ranging from personal resident information to technical mapping and visual media—indicates a broad scope of the alleged access to the organization's internal repositories.

About comcom-sgc

The organization involved, comcom-sgc, is associated with the Grand Couronné region in France. Grand Couronné is a former community of communes located in the Meurthe-et-Moselle department of France. It was dissolved in 2017 after merging with Seille et Mauchère.

Potential impacts and organizational risks

This incident suggests that the organization's digital assets and sensitive information belonging to local residents may be at risk. The alleged data leak could lead to violations of the GDPR regarding the protection of personal data, potentially resulting in administrative sanctions. Furthermore, secondary risks such as identity theft or targeted phishing attacks against residents may emerge as a result of the exposure of personal details.

For organizations operating within the government and public service sectors, such breaches present significant challenges. Given the role of such organizations in providing essential public services, disruptions in service continuity and a decline in public trust may be observed. Protecting digital infrastructure is critical for maintaining the integrity of public administration and ensuring the safety of citizen data.

To mitigate such risks, organizations in this sector often focus on implementing robust defensive measures. These typically include multi-factor authentication, regular security audits, and comprehensive data encryption to protect sensitive information both at rest and in transit. Additionally, maintaining strict access controls and implementing continuous monitoring of network traffic can help detect unauthorized activities before they escalate into large-scale data exfiltration events.