Prism Construction listed on Monti ransomware leak site

• Ransomware group: Monti
• Country: Canada
• Sector: Professional Services
• Announcement date: August 30, 2024

The threat actor known as Monti has listed Prism Construction on its leak site, claiming to have obtained company data. This announcement, made on August 30, 2024, indicates a potential data breach involving the Canadian-based organization.

The alleged incident

On August 30, 2024, the Monti group listed Prism Construction on its leak site. The group claims that sensitive information belonging to the company has been downloaded. According to the announcement, the stolen data will be made public if the company does not establish contact with the attackers. Information regarding the specific identity and background of this group remains limited.

The threat actor appears to be employing double extortion tactics. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to release confidential information publicly, the attackers aim to pressure the victim into paying a ransom to prevent reputational damage or regulatory scrutiny. This method significantly increases the risk of secondary incidents, as the publication of stolen data can lead to long-term consequences even if a ransom is paid.

Data involved in the claim

The claims made by the Monti group suggest that a variety of sensitive information has been compromised. The group has provided a screenshot displaying a sample of a non-disclosure agreement (NDA) to support their claims. According to the threat actor, the following types of information have been obtained:

• Customer information
• Employee information
• Contractual data

While the specific volume of data or the exact number of files stolen have not been disclosed by the group, the claim focuses on the confidentiality of these specific categories.

About Prism Construction

Prism Construction is a Canada-based construction company specializing in commercial and residential projects. As a player in the professional services sector, the organization manages various stakeholder relationships and complex project documentation.

Impact and security considerations

The alleged leak may pose significant risks to the organization and its stakeholders. For the company's employees and customers, the exposure of personal information could lead to risks such as identity theft or targeted phishing attacks. Furthermore, the disclosure of the company's business partnerships and contractual data could jeopardize supply chain security, potentially affecting the trust and stability of its professional network.

Because Prism Construction is based in Canada, the potential data breach may fall under the scope of PIPEDA regulations, which govern how private sector organizations handle personal information. Such regulatory oversight highlights the importance of robust data protection frameworks. The incident could also result in negative impacts on the organization's operational continuity and its overall reputation.

In the construction and professional services sectors, organizations often deal with high volumes of sensitive contractual and client data. To mitigate the risks associated with such attacks, organizations typically focus on strengthening their defensive posture. This includes implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to help employees recognize phishing attempts. Additionally, monitoring for unauthorized data exfiltration and ensuring strict access controls for sensitive documents are standard practices to defend against the types of double extortion tactics used by groups like Monti.