on365.co.uk targeted by Qilin ransomware group

• Ransomware group: Qilin
• Country: United Kingdom
• Sector: Technology
• Announcement date: August 16, 2024

Qilin ransomware group claims data breach at on365.co.uk

The Qilin ransomware group has listed the United Kingdom-based technology company on365.co.uk on its leak site, claiming to have successfully executed a data breach. According to the announcement posted on the group's platform on August 16, 2024, the threat actors allege they have gained unauthorized access to the organization's network and have acquired various documents.

The claim suggests that the breach occurred prior to the public announcement. While the group has published information regarding the incident, they have not provided specific details regarding the total size of the stolen data, the total file count, or the specific ransom demand required to prevent further exposure. The announcement is categorized as a data leak notification.

Details of the alleged data theft

The information provided by the Qilin group indicates that the stolen data includes sensitive documentation. Based on the evidence presented by the attackers, the breach involves several types of highly sensitive information that could be used for malicious purposes. The items identified in the leak include:

• Identity documents
• Passport-like records
• Corporate tables

The presence of such documentation in a leak suggests that the attackers have moved beyond simple system disruption and have focused on exfiltrating data that holds significant value for extortion purposes.

About on365

On365 is a technology company that has been operating since 1984. The organization specializes in critical infrastructure components, specifically focusing on data center infrastructure, power management, and cooling efficiency. Their professional services include the design, installation, maintenance, and optimization of data center facilities, providing essential technical support to ensure these environments function effectively.

Impact and risks of the breach

The exposure of the data claimed by the Qilin group carries significant risks for the organization and its stakeholders. The nature of the stolen information, particularly identity documents and passport-like records, poses a high risk of identity theft for the organization's employees or its clients. Furthermore, because on365 is based in the United Kingdom, this breach could potentially lead to legal sanctions under the UK GDPR framework due to the sensitive nature of the compromised data.

The group appears to be employing double extortion tactics. In a double extortion scenario, ransomware actors do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data and threaten to publish it on a public leak site to pressure the organization into paying a ransom. This method increases the pressure on the victim, as the threat of reputational damage and legal consequences becomes a primary motivator for payment.

The exposure of corporate tables and personal identifiers can damage the commercial reputation of the organization. Additionally, such data can be utilized by threat actors to facilitate secondary attacks, such as highly targeted phishing campaigns aimed at specific individuals within the company or its client base. To defend against such threats, organizations in the technology and infrastructure sectors often implement robust security measures, including multi-factor authentication, regular network monitoring, and strict data encryption protocols to mitigate the impact of unauthorized access.