Notaires.fr data allegedly leaked by Cloak ransomware group

• Ransomware group: Cloak
• Country: France
• Sector: Professional Services
• Announcement date: August 24, 2023

The Cloak ransomware group has officially listed data on its leak site that it claims belongs to Notaires.fr. This announcement, made on August 24, 2023, marks a significant escalation in the ongoing tension between the threat actor and the French organization.

The claims of the Cloak ransomware group

According to the claims made by the threat actor known as Cloak, the group successfully obtained data belonging to Notaires.fr. The group has since listed this information on their dedicated leak site. The circumstances surrounding the leak, as alleged by the attackers, involve a breakdown in communication between the organization and the criminals. The group alleges that the management of Notaires.fr refused to enter into negotiations with them. Instead of engaging in discussions regarding the stolen data, the organization reportedly contacted law enforcement authorities. Following this decision by the organization, the threat actor announced that they would make the organization's data publicly available to the public.

In modern cyberattack landscapes, this behavior is characteristic of double extortion tactics. In such scenarios, ransomware groups do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The threat of releasing this data publicly serves as additional leverage to pressure the victim into paying a ransom. If negotiations fail, the attackers move from encryption to public exposure, often using leak sites to damage the victim's reputation and increase pressure through public shame.

The nature of the leaked data

While the specific volume and file count of the breach remain unknown, the group has provided evidence of the stolen information through various screenshots. These visual proofs suggest that the breach involves highly sensitive documentation related to legal and financial transactions. The leaked content appears to include a variety of critical documents that are central to the organization's operations.

Affected data types include:

• Rental management contracts
• Notarial transaction documents
• Bank transfer information
• Insurance notifications

The presence of such data indicates that the breach touches upon the core administrative and legal functions of the organization. The exposure of bank transfer instructions and transaction documents is particularly concerning due to the financial nature of the information involved.

About Notaires.fr

Notaires.fr is the official website of the Conseil supérieur du notariat (CSN). This entity serves as the representative body for the notarial profession in France. The platform is designed to provide essential information and guidance to the public regarding various notarial services, legal procedures, and real estate transactions. As a central hub for legal and property-related information in the country, the organization plays a vital role in the French legal and administrative infrastructure.

Implications and organizational risks

The leaked documents may contain sensitive personal and financial information related to notarial activities. This exposure creates significant risks for the affected individuals, including the potential for identity theft and various forms of fraud. Because the organization is based in France, this incident may trigger mandatory data breach notification obligations under the General Data Protection Regulation (GDPR).

In sectors built upon a foundation of trust, such as notarial services, a leak of this nature can lead to severe consequences for the organization's reputation and may undermine the trust that clients place in the institution. Furthermore, the stolen data could potentially be utilized in secondary attacks. Specifically, the information could be leveraged in highly targeted spear-phishing campaigns, where attackers use stolen details to craft convincing messages to trick individuals or employees.

To defend against such threats, organizations in the professional services sector often implement defensive strategies such as robust encryption for data at rest and in transit, multi-factor authentication, and continuous monitoring of network traffic. Organizations must also prioritize regular security awareness training to help staff recognize phishing attempts and maintain strict access controls to sensitive legal and financial documentation.