Nuclep targeted by meow ransomware group in alleged data breach

• Ransomware group: meow
• Country: Brazil
• Sector: Manufacturing
• Announcement date: July 26, 2024

The threat actor known as meow has published a leak announcement on a ransomware leak site, claiming to possess 250 GB of data belonging to Nuclep. The announcement, posted on July 26, 2024, alleges that the organization's systems were compromised on the same day.

The alleged attack by meow

The meow group has created a leak announcement claiming that data belonging to Nuclep has been compromised. According to the group's claims, the collection includes sensitive documents related to the organization's defense industry and nuclear energy operations. The threat actor is demanding a ransom for the return or non-disclosure of the data, offering different pricing options ranging from $500,000 to $1,500,000.

Publicly available information regarding the meow group remains limited, as there is little documentation in the public domain concerning their specific tactics, techniques, or infrastructure. The group appears to be utilizing a double extortion strategy, a common ransomware tactic where attackers not only encrypt an organization's data but also threaten to leak sensitive information on a public forum to pressure the victim into paying the ransom.

Alleged data contents and affected information

According to screenshots provided by the threat actor, the allegedly leaked data is highly sensitive and covers various critical industrial and personal sectors. The information is said to include defense production records, nuclear submarine designs, and various multimedia files such as videos and photos of uranium extraction. Furthermore, the leak allegedly contains Autocad designs (3D and DWG formats), oil and gas data, and geographic coordinates.

In addition to technical and industrial files, the group claims to have obtained personal information belonging to the organization's staff. The affected data types allegedly include:

• Employee email addresses
• Employee passwords
• Employee names
• Defense industry design documents
• Nuclear energy production data
• Geographic coordinates

About Nuclep

Nuclep (Nuclebrás Equipamentos Pesados S.A.) is a Brazilian state-owned company that manufactures heavy equipment for nuclear and conventional power plants, as well as the defense industry. The organization specializes in the production of critical components for submarine and nuclear energy projects.

Impact assessment and security implications

Given the nature of the allegedly leaked data, there may be significant negative impacts on the organization's operational security and national defense projects. The exposure of highly technical files, such as submarine designs and uranium extraction media, poses a risk to strategic national interests. Furthermore, the exposure of employee data, including names, emails, and passwords, could lead to identity theft or targeted phishing attacks against the organization's personnel.

Because the organization is based in Brazil, the incident may trigger legal sanctions and compliance processes under the LGPD (General Data Protection Law). Additionally, the leak of defense industry data could create secondary risks regarding supply chain security, as partners and contractors may be exposed to the fallout of the breach. The threat actor's use of double extortion to sell the data increases the likelihood that the information may be transferred to various third parties.

For organizations operating in critical infrastructure and defense sectors, such incidents highlight the necessity of robust security frameworks. Common defensive steps often include implementing multi-factor authentication to protect employee credentials, maintaining strict segmentation of industrial control systems from administrative networks, and ensuring comprehensive encryption for sensitive design files. Additionally, organizations must prepare for regulatory compliance and incident response protocols to manage the legal and operational consequences of a potential data leak.