Reach Cooling Group targeted by ALPHV ransomware group

• Ransomware group: ALPHV
• Country: United States
• Sector: Manufacturing
• Announcement date: July 26, 2023

ALPHV claims data breach at Reach Cooling Group

The ALPHV ransomware group, also known as BlackCat, has published a notice on its leak site claiming responsibility for a cyberattack against Reach Cooling Group. According to the announcement made on July 26, 2023, the threat actors claim to have exfiltrated various sensitive records belonging to the organization. The group has issued a threat stating that if the company does not make contact within a 48-hour window, the stolen data will be released to the public.

The incident involves a significant breach of information that could impact the company's operational continuity and commercial reputation. While the group has posted an announcement on their leak site, the specific details regarding the total volume of data or the exact ransom demand remain unknown, as no information was provided regarding the size of the data or a specific monetary demand.

Details of the claimed attack and exfiltrated data

The ALPHV group alleges that they successfully gained access to the Reach Cooling Group network by exploiting vulnerabilities within the organization's systems. This method of entry allowed the attackers to navigate the internal environment and identify high-value information for exfiltration. The group's announcement suggests that the breach occurred around May 21, 2023, though this date is based on the claims made by the attackers.

The data allegedly stolen by the group is diverse, encompassing both corporate and highly sensitive personal information. Based on the screenshots provided by the attackers, the compromised information includes a wide range of documentation that could be used for various malicious purposes. The affected data types identified in the leak include:

• Passport information
• Financial documents
• Logistics documents
• Personal data
• Insurance information
• Non-disclosure agreements (NDA)
• Credit card details

The presence of such sensitive information, including tax forms and corporate financial statements, indicates a deep level of access into the company's administrative and financial operations.

About Reach Cooling Group

Reach Cooling Group is an international manufacturing company that specializes in the production of automotive cooling systems and components. The organization maintains a global footprint with its headquarters located in Florida, United States. In addition to its US-based management, the company operates manufacturing facilities located in China to support its international supply chain and production needs.

Impact and risk assessment

The breach of Reach Cooling Group carries significant risks for multiple stakeholders. For employees and business partners, the exposure of passport information, personal data, and credit card details increases the risk of identity theft and fraudulent activities. Furthermore, the leak of financial and logistics documents could potentially be leveraged by threat actors to launch secondary attacks against the company's broader supply chain.

Because the company is headquartered in the United States, this incident may trigger legal proceedings under relevant state laws and federal regulations, depending on the specific nature of the compromised data. Such regulatory scrutiny often follows breaches involving personal and financial information.

The ALPHV group is recognized in the threat intelligence community for its use of Rust-based tools and its employment of double-extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt a victim's data to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the pressure to pay the ransom.

To defend against such threats, organizations in the manufacturing sector often implement defensive measures such as robust network segmentation, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized access. Strengthening supply chain security and ensuring compliance with data protection regulations are also vital steps for mitigating the impact of potential data disclosures.