Okada Manilla listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Philippines
• Sector: Hospitality
• Announcement date: December 29, 2023

ALPHV claims Okada Manilla has been targeted in a data breach

The ALPHV ransomware group has officially listed Okada Manilla on its dedicated leak site. According to the claims made by the threat actors, the organization has been compromised, and the group has indicated that they have already taken steps to contact the organization's customers directly.

This development marks a significant escalation in the pressure applied by the ransomware group against the hospitality giant. By moving from initial infiltration to public listing, the attackers are utilizing public exposure as a tool for coercion.

The claims made by the ALPHV group

The incident was announced on the ALPHV leak site on December 29, 2023. In their announcement, the threat actors stated that their previous attempts to establish contact with the organization were unsuccessful. This lack of communication from the victim organization appears to have prompted the group to move forward with public disclosure.

The group has claimed that they have already informed the organization's customers regarding their payment obligations. Furthermore, the attackers have issued a warning suggesting that further data exposure may occur in the future if their demands are not met. This tactic is a hallmark of modern ransomware operations, where the threat of continued leaks is used to force a response.

Details regarding the alleged leaked data

While the specific volume of the stolen data has not been disclosed, the screenshots provided by the attackers offer some insight into the nature of the breach. The available evidence includes images of SQL Server database objects, various lists of documents, and the organization's logo. However, detailed information regarding the full scope and the exact content of the leaked data remains unavailable at this time.

Based on the information provided by the group, the following types of data are reportedly affected:

• Customer information
• SQL database objects

The presence of database objects in the leaked screenshots suggests that the attackers may have gained significant access to the underlying data structures used by the organization.

About Okada Manilla

Okada Manila is a large-scale integrated resort, hotel, and casino located in Manila, Philippines. The facility offers luxury accommodations, extensive gaming areas, and various entertainment services, serving a wide range of international and local clientele.

Analysis and potential impact of the incident

This incident may be intended to exert direct pressure on the organization's customers. By targeting the individuals who patronize the resort, the attackers aim to create a sense of urgency and panic. The exposure of customer data could lead to a significant loss of reputation and a decline in customer trust for the organization, which is critical in the hospitality and gaming sectors.

Furthermore, the data breach may trigger legal proceedings under data privacy regulations in the Philippines. Beyond the immediate legal risks, the ALPHV group appears to be employing double extortion tactics. This method involves both encrypting data and threatening to leak it, which can pose a high risk for secondary phishing attacks against the victims whose information has been exposed.

The organization's operational continuity may also be at risk of disruption due to the potential compromise of database access. In the hospitality sector, where seamless service is paramount, any compromise of core databases can lead to significant operational hurdles. Organizations in this sector often focus on robust data encryption, strict access controls, and comprehensive employee training to mitigate such risks.