Qiulong ransomware group lists www.concisa.eng.br on its leak site

• Ransomware group: Qiulong
• Country: Brazil
• Sector: Professional Services
• Announcement date: June 24, 2024

The threat actor group known as Qiulong has claimed responsibility for a data breach involving the Brazilian company Concisa Obras de Infraestrutura. According to an announcement made on the group's leak site, the attackers claim to have exfiltrated a significant volume of sensitive information belonging to the organization.

The claimed attack and data exfiltration

On June 24, 2024, the Qiulong group listed Concisa Obras de Infraestrutura on its dedicated leak site, alleging that a successful data breach occurred. The threat actors claim to have obtained approximately 30GB of data, which they assert is related to the company's operational processes and various infrastructure projects. The announcement included samples of the company's financial documents as well as personal data belonging to the company's CEO to support their claims.

Ransomware groups often utilize leak sites as part of a double extortion strategy. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to publish this information publicly, the group aims to pressure the victim into paying a ransom to prevent the disclosure of proprietary or personal information. This tactic shifts the pressure from mere operational downtime to significant reputational and legal risks.

Data types involved in the breach

The information allegedly stolen by the Qiulong group encompasses a wide range of sensitive corporate and personal documentation. Based on the group's claims, the stolen data includes:

• Financial data
• Contracts
• Email archives
• Personal identification information

The specific contents mentioned in the leak include company financial statements, budget reports, and various contracts. Furthermore, the group claims to have accessed non-disclosure agreements (NDAs), email archives, and personal identification documents belonging to the company's CEO.

Impact and organizational risks

The exposure of such sensitive data can lead to various negative consequences for the organization and its personnel. For the company, the breach may negatively impact business operations and lead to a loss of commercial reputation. Furthermore, the exposure of sensitive corporate information can weaken the security of the broader supply chain.

For the individuals involved, particularly the CEO whose personal identification documents were reportedly included, the risks are significant. The release of personal data can lead to secondary risks such as identity theft and the execution of targeted phishing attacks. Such attacks often use the stolen information to craft highly convincing messages designed to trick employees or executives into revealing further credentials or transferring funds.

From a regulatory perspective, the company may face specific legal obligations. Under Brazil's LGPD regulations, the organization may be required to fulfill data breach notification obligations and could potentially face administrative sanctions. While information regarding the specific methods or identity of the Qiulong group remains limited, the potential for multifaceted impact remains high.

General defensive measures

To mitigate the risks associated with such breaches, organizations in the professional services and infrastructure sectors often implement various defensive strategies. These include maintaining robust backup solutions to ensure operational continuity and implementing strict access controls to limit the exposure of sensitive data. Additionally, monitoring for unauthorized data exfiltration and conducting regular security awareness training can help reduce the likelihood of successful attacks and minimize the impact if a breach occurs.