Noname ransomware group lists onyx-fire.com on its leak site

• Ransomware group: Noname
• Country: United States
• Sector: Professional Services
• Announcement date: January 16, 2024

Noname group claims data breach at Onyx-Fire Protection Services Inc

The threat actor known as Noname has published an announcement on its leak site claiming to possess a significant amount of data belonging to Onyx-Fire Protection Services Inc. According to the post, the group has exfiltrated approximately 800 GB of data from the organization's systems.

Ransomware groups often utilize leak sites to host announcements regarding successful attacks. This practice is frequently associated with double extortion tactics, where attackers not only encrypt an organization's systems but also steal sensitive information to pressure the victim into paying a ransom. By threatening to release the stolen data publicly, the attackers aim to maximize their leverage over the target organization.

Details of the alleged attack

The announcement made by the Noname group was published on January 16, 2024. While the disclosure occurred in early 2024, the group claims that the unauthorized access to the institution's systems actually took place much earlier, specifically on September 12, 2023. This discrepancy between the attack date and the announcement date is common in cyberattacks, as threat actors may spend months conducting reconnaissance, exfiltrating data, and negotiating before making a public claim.

The claim suggests that the attackers gained unauthorized access to the internal systems of the company, allowing them to extract a massive volume of information. The sheer scale of the alleged theft, totaling 800 GB, indicates a sustained period of access within the network to facilitate such a large-scale data transfer.

Alleged data types involved in the leak

The information allegedly stolen by the Noname group is extensive and covers several critical areas of the organization's operations. The leaked data is said to include sensitive financial documents, such as balance sheets, budget reports, bank statements, tax forms, and audit reports. Furthermore, the breach reportedly involves highly sensitive personal information belonging to employees, including social security numbers, residential addresses, dates of birth, and salary details.

In addition to financial and personal records, the group claims to have obtained:

• Customer data
• Non-disclosure agreements (NDA)
• Various project files
• Contracts

The exposure of such diverse data types—ranging from internal business contracts to private employee identifiers—represents a significant security failure for the targeted entity.

About Onyx-Fire Protection Services Inc

Onyx-Fire Protection Services Inc is an American company specializing in the design, installation, and maintenance of fire safety systems. They provide fire detection and suppression solutions for commercial and industrial facilities. Given their role in providing critical safety infrastructure, the integrity of their data is vital to their operational security and client trust.

Impact and organizational considerations

This incident may increase the risk of identity theft and fraud for the institution's employees and customers due to the nature of the stolen personal information. Furthermore, the exposure of financial records could potentially impact the institution's business operations and competitive standing. Because the organization is a US-based entity, it may be subject to data breach notification requirements under relevant state laws and federal regulations.

Public information regarding the Noname group is limited, which complicates the analysis of their specific methods and motivations. For organizations operating in the professional services sector, such incidents highlight the necessity of robust incident response plans. When a breach is suspected, organizations may need to initiate a forensic investigation to determine the full scope of the breach and notify all affected parties. Defensive measures typically include implementing multi-factor authentication, maintaining strict network segmentation, and conducting regular audits to detect unauthorized access early.