Procurri listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Canada
• Sector: Technology
• Announcement date: July 26, 2023

Technology company Procurri targeted by ALPHV ransomware group

The technology company Procurri has been listed on the leak site operated by the ALPHV ransomware group. According to the claims made by the threat actors, the company's network security was insufficient, allowing them to gain unauthorized access to sensitive information. This listing follows a claimed attack date of May 26, 2023, with the official announcement appearing on the group's leak site on July 26, 2023.

Details of the alleged breach

The ALPHV group has published data that they claim belongs to Procurri. In their announcement, the threat actors allege that the company's network security was weak, which facilitated the intrusion. The group claims to have obtained a variety of sensitive materials, including financial documents and personal data belonging to the company's business partners. Furthermore, the group states that they have shared the company's internal network map alongside various operational documents.

The information released by the group includes screenshots that purportedly show a wide range of internal documentation. The data allegedly leaked includes:

• Financial documents
• Accounting records
• Business partner personal data
• Customer personal data
• Network topology information

About Procurri

Procurri is a global technology company that specializes in IT lifecycle management, hardware maintenance, and cloud services. The company provides end-to-end IT infrastructure solutions through channel partners, focusing on delivering services that extend beyond traditional IT channels.

Impact and security implications

This leak may pose secondary risks such as identity theft and targeted phishing attacks for Procurri's customers and business partners. The exposure of such sensitive information often leads to increased vulnerability for the affected parties. Additionally, the scope of the leak could damage the company's commercial reputation and create negative impacts on supply chain security.

The ALPHV (BlackCat) group is known as an entity that adopted double extortion methods using Rust-based ransomware. Double extortion is a tactic where attackers not only encrypt a victim's data but also threaten to leak sensitive information on public forums to pressure the organization into paying the ransom. This method significantly increases the pressure on companies to comply with demands.

Furthermore, the incident may trigger legal processes under data protection regulations in the regions where the company operates, such as Canada's PIPEDA or GDPR. For organizations operating in the technology and IT services sector, maintaining robust security protocols is essential to protect against such threats. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security audits to identify and patch vulnerabilities before they can be exploited by threat actors.