Powerhouse Retail Services LLC targeted by Noescape ransomware group

• Ransomware group: Noescape
• Country: United States
• Sector: Professional Services
• Announcement date: September 26, 2023

Noescape claims data breach at Powerhouse Retail Services LLC

The Noescape ransomware group has announced a significant data breach involving Powerhouse Retail Services LLC. According to an announcement made on a leak site on September 26, 2023, the threat actors claim to have exfiltrated 21 GB of sensitive information belonging to the organization. This incident follows a period of unauthorized access that the group alleges occurred earlier in the month.

Ransomware attacks often involve a phase where attackers gain access to a network and move laterally to identify high-value assets. Once the data is identified, the attackers typically attempt to exfiltrate it before deploying encryption software to lock the victim's systems. This dual-pronged approach is a hallmark of modern cybercriminal operations.

Details of the alleged attack

The threat actor known as Noescape alleges that it successfully breached the networks of Powerhouse Retail Services LLC on September 20, 2023. Following the initial breach, the group claims to have encrypted the organization's data, effectively disrupting their digital operations. The group has stated that the company management has not initiated contact with them regarding the incident.

Due to the lack of communication from the organization, the attackers have resorted to publishing the stolen data on their dedicated leak site to exert pressure. This tactic is a core component of double-extortion ransomware campaigns. In such scenarios, the attackers do not merely demand a ransom to decrypt files; they also threaten to release sensitive, stolen information to the public or to specific stakeholders to increase the likelihood of payment. Publicly available information regarding the specific capabilities and history of the Noescape group remains limited.

The scope of the stolen data

The information allegedly stolen by the Noescape group is extensive and covers various critical business and personal categories. The group claims that the stolen dataset includes a wide range of documents that could be highly sensitive for both the company and its stakeholders. The alleged data includes:

• Agreements
• Project lists
• Legal documents
• Banking records
• Tax records
• Budget reports
• Employee data
• Customer data
• Vendor data
• ID cards
• Payment documents
• Invoices
• Checks
• Insurance records
• Licenses
• Technical infrastructure documentation

The breadth of this data suggests a deep penetration into the organization's file servers and administrative systems. When such a diverse set of documents is compromised, it often includes the very foundation of a company's operational and legal standing.

About Powerhouse Retail Services LLC

Powerhouse Retail Services is a service provider specializing in commercial infrastructure maintenance, facilities management, exterior services, and store rollout/refresh programs. The company offers turnkey solutions for retail and commercial businesses, providing essential support for the physical upkeep and expansion of commercial properties.

Implications and risks for the sector

Given the nature of the alleged data, there may be a risk of identity theft and targeted phishing attacks for the organization's employees and customers. The presence of ID cards, banking records, and personal information makes individuals within the organization's ecosystem vulnerable to social engineering and fraudulent activities.

Considering the sector and the types of data involved, the incident may trigger data breach notification requirements and legal processes under relevant US state laws. Organizations operating in the professional services sector must be aware that such breaches can create negative impacts on commercial reputation and operational continuity. To mitigate these risks, organizations typically focus on robust security frameworks, including multi-factor authentication, regular employee training to recognize phishing, and maintaining offline backups to ensure recovery in the event of encryption.