Noname group claims data breach against selmi.com.br

• Ransomware group: Noname
• Country: Brazil
• Sector: Agriculture and Food Production
• Announcement date: January 16, 2024

Noname group claims data breach against selmi.com.br

The threat actor known as Noname has listed a significant amount of data on its leak site, claiming the information belongs to the Brazilian food manufacturer selmi.com.br. According to the announcement, the group has exfiltrated a substantial volume of data from the organization's network.

Details of the alleged attack

The threat actor known as Noname claims to have successfully compromised the network of selmi.com.br. According to the group's announcement, they managed to obtain full access to the organization's network infrastructure, which allowed them to carry out the exfiltration of data. The announcement regarding this incident was posted on the group's leak site on January 16, 2024. While the announcement was made in early 2024, the group cites the alleged incident date as September 12, 2023, suggesting the breach may have occurred months before the public disclosure.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a tactic known as double extortion. In these scenarios, attackers not only encrypt a company's systems to disrupt operations but also steal sensitive data to threaten its public release. This method increases the pressure on the victim, as the exposure of proprietary or personal information can cause long-term reputational and legal damage even if the systems are restored from backups.

Data involved in the claim

Regarding the specific nature of the information stolen, the group has not provided detailed descriptions of the file types or the specific contents of the stolen data. The listing only indicates the volume of the data involved. The following information was provided by the threat actor:

• Claimed data size: 150 GB

The listing names no specific data types or individual file categories beyond the total size mentioned in the screenshot provided by the group.

About selmi.com.br

Founded in 1966, Selmi is a Brazilian food company that manufactures dry pasta, fresh pasta, cookies, crackers, cakes, and baking mixes. The company operates with two production sites and thirteen distribution centers across the country.

Risk assessment and industry implications

Public information regarding the Noname group remains limited, making it difficult to determine their specific tactics, techniques, and procedures. However, the alleged exfiltration of 150 GB of data poses significant risks to the organization. Such a breach may impact the company's operational processes, compromise trade secrets, or expose sensitive information related to employees.

Under Brazil's LGPD (General Data Protection Law), the organization may face legal consequences if personal data belonging to customers or employees is exposed. Furthermore, there is a possibility that the stolen data could be utilized in secondary attacks or targeted phishing campaigns against the company or its stakeholders. This creates a potential threat environment for the organization's supply chain partners and customers, who may be targeted due to the leaked information.

To defend against such threats, organizations in the food production and agriculture sectors can implement several defensive measures. These include maintaining robust network segmentation to prevent lateral movement by attackers, implementing strict access controls, and conducting regular audits of data access. Additionally, organizations should focus on comprehensive monitoring of their network to detect unauthorized data exfiltration and ensure that all sensitive data is encrypted both at rest and in transit. Maintaining a strong incident response plan is also critical for mitigating the impact of a potential breach.