OilTanking GmbH and Mabanaft GmbH listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Germany
• Sector: Energy & Utilities
• Announcement date: January 29, 2022

The ALPHV ransomware group has listed OilTanking GmbH and Mabanaft GmbH on its dedicated leak site. This announcement, made on January 29, 2022, indicates that the threat actor claims to have successfully breached the networks of these two entities and obtained data from them.

The claims made by ALPHV

According to the announcement posted on the group's leak site, the threat actor claims to have gained unauthorized access to the internal networks of both OilTanking GmbH and Mabanaft GmbH. This claim was made on the same day the listing appeared, January 29, 2022. Such actions are a hallmark of modern ransomware operations, where groups often utilize a double extortion tactic. In these scenarios, attackers do not merely encrypt files to disrupt operations but also focus on exfiltrating sensitive information to use as leverage during ransom negotiations.

The listing is part of the broader ransomware operations conducted by the ALPHV group. This group is recognized in the cybersecurity community as a Ransomware-as-a-Service (RaaS) structure. They are known for utilizing sophisticated malware written in the Rust programming language to carry out their attacks. While reports indicate that the group's operations were reported to have ceased as of March 2024, the impact of historical data leaks can often persist long after the initial incident.

Details regarding the alleged data breach

Regarding the specifics of the breach, the current information remains limited. There is no information regarding the nature of the leaked or threatened data. Furthermore, the group has not provided any screenshots to substantiate their claims or to demonstrate the contents of the stolen information. The listing does not specify the volume of data taken or the number of files involved in the incident.

Organization profiles

The targeted entities, OilTanking GmbH and Mabanaft GmbH, are companies belonging to the German-based Marquard & Bahls group. These organizations play significant roles within the energy and utilities sector. OilTanking provides specialized storage services for oil, gas, and chemical products on a worldwide scale. Meanwhile, Mabanaft operates within the energy sector, focusing on the trading and distribution of various energy products.

Potential risks and industry implications

This situation may pose significant risks to the operational continuity of the organizations involved. The disclosure of sensitive information can lead to various secondary risks. For instance, if personal or corporate data is leaked, it can facilitate identity theft or enable highly targeted phishing attacks directed at employees and business partners. Such attacks often use the stolen context to appear legitimate, increasing the likelihood of further compromise.

Because these organizations are located in Germany, a potential data breach could trigger complex legal processes and administrative sanctions under the General Data Protection Regulation (GDPR). Organizations in the energy and utilities sector must remain vigilant, as they are often considered critical infrastructure. To mitigate such risks, companies typically focus on robust network segmentation, continuous monitoring for unauthorized access, and comprehensive employee training to recognize social engineering attempts. Even when a ransomware group has ceased operations, the long-term consequences of a data leak can remain a persistent threat to organizational security and reputation.