Ragnar Locker ransomware group lists DOIT - Canadian IT company allowed leak of its own clients. on its leak site

• Ransomware group: Ragnar Locker
• Country: Canada
• Sector: Technology
• Announcement date: September 2, 2023

The Ragnar Locker ransomware group has published a data leak announcement targeting the Canadian technology firm DOIT. According to the claims made by the threat actors on their leak site, the organization has suffered a significant breach resulting in the exposure of sensitive information belonging to its client base.

The alleged attack and claims by Ragnar Locker

The Ragnar Locker group alleges that the data breach occurred due to vulnerabilities within the network security of DOIT. The threat actors claim that the technology company failed to adequately address existing security issues, which allowed the attackers to gain access to the network. As a result of this alleged failure, the group claims to have exfiltrated a substantial amount of data.

The group has listed 613 GB of data on their dedicated leak site. In a move typical of modern ransomware operations, the attackers have also issued a warning to other organizations currently working with DOIT. The announcement advises these third-party entities to terminate their cooperation with the Canadian IT company immediately to avoid potential risks.

Details regarding the leaked data

While the specific nature and exact contents of the leaked files have not been explicitly detailed in the announcement, the listing identifies several sectors that are represented among DOIT's clients. The announcement mentions that the leaked data involves various organizations operating within the following sectors:

• Financial organizations
• Legal organizations
• Healthcare organizations

The group has not provided specific information regarding the exact types of files or the specific nature of the data contained within the 613 GB of information.

The target organization

The target of this alleged attack is DOIT, a technology company based in Canada. As an IT service provider, the company serves a variety of clients across different industries, making it a high-value target for threat actors looking to achieve broad impact through supply chain compromises.

Implications and risk assessment

This alleged leak poses significant data privacy risks for the various clients served by DOIT. Because the data belongs to third-party organizations, the breach could trigger complex legal and regulatory consequences. In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) requires organizations to manage and report data breaches, which may lead to formal legal processes for the affected entities.

If the leaked data contains sensitive client information, the consequences could escalate to include identity theft or highly targeted phishing attacks against the individuals or organizations involved. The methodology used by Ragnar Locker—exfiltrating data prior to the encryption phase—is a hallmark of double extortion. This tactic places immense pressure on victims, as they face the threat of public data exposure even if they can recover their systems from backups.

For organizations operating within the technology and IT services sector, this incident highlights the critical importance of supply chain security. Companies must conduct thorough risk assessments regarding their vendors and service providers. Defensive measures typically include implementing robust network security to prevent unauthorized access, maintaining strict monitoring of data exfiltration, and ensuring that all known security vulnerabilities are patched promptly to prevent threat actors from exploiting them.