Orion listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: South Korea
• Sector: Agriculture and Food Production
• Announcement date: July 26, 2023

ALPHV claims data theft from Orion

The ALPHV ransomware group has listed the South Korean food company Orion on its leak site. According to the group's announcement, which was made on July 26, 2023, they claim to have accessed and exfiltrated a significant amount of data belonging to the organization. The group alleges that the breach occurred around May 16, 2023, suggesting that the attackers may have maintained unauthorized access to the organization's internal networks for a period of time before the public announcement was made.

The incident follows a common pattern seen in modern cyberattacks known as double extortion. In these scenarios, threat actors do not merely encrypt a victim's systems to disrupt operations; they also focus on stealing sensitive information. By threatening to release this data on a public leak site, the attackers aim to increase the pressure on the organization to pay a ransom. This tactic is particularly effective against large corporations where the exposure of internal documents can lead to significant reputational and legal consequences.

Details of the alleged data exfiltration

The ALPHV group claims to have stolen approximately 1TB of data from Orion. The group alleges that the stolen information includes sensitive documents related to industry employees in both Korea and China. Furthermore, the group claims that non-disclosure agreements are among the files they have obtained. While the specific file count was not provided in the announcement, the volume of data suggests a substantial breach of the corporate environment.

Based on the files listed in the screenshots provided by the group, the exfiltrated information is reported to include:

• Employee data
• Non-disclosure agreements
• Corporate documents

The presence of such diverse document types indicates that the attackers may have targeted various departments within the organization, ranging from human resources to legal and corporate administration.

About Orion

Orion Corporation is a prominent confectionery company headquartered in Seoul, South Korea. It holds a significant position in the regional market and is recognized as one of the three largest food companies in the country. The company specializes in the production of a wide variety of snacks and food products, serving a large consumer base.

Potential impact and risks

The alleged exfiltration of employee information and non-disclosure agreements presents several high-level risks to the organization. The exposure of personal employee data can significantly increase the risk of identity theft and makes staff members targets for highly specific, targeted phishing attacks. Such attacks often use stolen personal details to appear legitimate, making them harder for employees to detect.

From a regulatory perspective, the organization could face legal sanctions under South Korea's Personal Information Protection Act (PIPA) due to the potential exposure of sensitive data. Additionally, the disclosure of trade secrets and internal corporate documents could result in a long-term loss of competitive advantage in the food production sector.

The ALPHV group utilizes a Rust-based Ransomware-as-a-Service (RaaS) model. This model allows different affiliates to use the group's infrastructure to carry out attacks, which can lead to stolen data being sold on secondary markets or used for further extortion attempts. To defend against such threats, organizations in the food and agriculture sector often implement defensive steps such as multi-factor authentication, network segmentation, and continuous monitoring of internal traffic to detect unauthorized access early.