RansomHub ransomware group lists bakpilic.com.tr on its leak site

• Ransomware group: RansomHub
• Country: Türkiye
• Sector: Agriculture and Food Production
• Announcement date: September 23, 2024

RansomHub claims to have stolen data from Bakpilic

The ransomware group known as RansomHub has published a claim on its leak site regarding a cyberattack against the Turkish poultry company, bakpilic.com.tr. According to the announcement made on September 23, 2024, the threat actors claim to have exfiltrated 430 GB of data belonging to the organization. The group asserts that the attack itself took place on September 22, 2024.

The threat actor known as RansomHub claims to have gained access to the systems of bakpilic.com.tr and exfiltrated various data. To support their claims, the group has shared images on their leak site that allegedly contain the institution's financial statements, database directories, and backup files. This type of public exposure is a hallmark of modern ransomware operations, where attackers use the threat of leaking sensitive information to pressure victims into paying a ransom.

Details of the alleged data exfiltration

The information shared by the attackers includes various types of sensitive corporate documentation. Based on the screenshots provided by the group, the leaked content includes financial reports, bank account details, and specific SQL database files, such as Logo_Connect, T2_Bordro, and BAKKONYA21, alongside various backup files.

The data types identified in the leak claim include:

• Financial data
• Accounting records
• Database backups
• Production and sales data

The presence of such diverse data types suggests a significant breach of the organization's internal information systems. While the group has provided screenshots to demonstrate the scope of the theft, the full extent of the breach remains to be verified through independent investigation.

About Bakpilic

Bakpilic is a Turkish poultry company. It operates in the production, processing, and distribution of fresh and frozen chicken meat products.

Analysis and potential impact

The allegedly leaked data, including financial statements and database backups, may pose a risk to the institution's operational continuity and trade secrets. If personal data is involved, legal obligations and administrative sanctions under the KVKK (Turkish Data Protection Law) may arise. The potential exposure of this data to third parties could create secondary risks such as phishing or targeted attacks against the institution's supply chain partners.

Given that the RansomHub group is known to have absorbed affiliates from ALPHV, it is assessed that such leaks are likely conducted via double-extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt a victim's data to disrupt operations but also steal sensitive information beforehand to threaten its public release if the ransom is not paid.

In such scenarios, organizations often face complex challenges. The exposure of financial and production data can damage a company's competitive position and trust with partners. To mitigate these risks, organizations typically need to conduct a comprehensive forensic investigation to determine the scope of the data breach and identify the entry point used by the attackers. Defensive measures in these sectors often involve robust backup management, strict access controls, and continuous monitoring of network traffic to detect unauthorized data exfiltration.