Reward Hospitality from EFC Group listed by BlackSuit ransomware group

• Ransomware group: BlackSuit
• Country: Australia
• Sector: Hospitality
• Announcement date: July 20, 2024

BlackSuit claims data breach at Reward Hospitality from EFC Group

The threat actor known as BlackSuit has listed Reward Hospitality from EFC Group on its dedicated leak site. According to the group's announcement, the organization has been targeted in a cyberattack, and the group claims to have successfully exfiltrated a significant volume of data. The total amount of data allegedly stolen is approximately 385 GB.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to pressure the victim into paying a ransom. If the ransom is not met, the attackers threaten to publish the stolen data publicly, causing reputational and legal damage. This method increases the leverage held by the threat actor, as the threat of a public data leak can be more damaging than the immediate operational downtime caused by encryption.

Details of the alleged attack

The listing of Reward Hospitality on the BlackSuit leak site occurred on July 20, 2024. The group claims that the attack took place on the same day, July 20, 2024. The threat actor asserts that they have obtained a wide array of sensitive information belonging to the organization, spanning financial, operational, and personal data categories.

The contents of the alleged leak are extensive and include various types of sensitive documentation. The data claimed to be in the possession of the attackers includes:

• Financial reports
• Budget documents
• Employee tax file numbers (TFN)
• Payroll data
• Personal identification information
• Customer contracts
• Logistics records
• SQL databases
• Email correspondence

The inclusion of such diverse data types suggests a deep level of access into the organization's internal systems, potentially affecting multiple departments from human resources and finance to logistics and customer management.

About Reward Hospitality from EFC Group

Reward Hospitality is a major supplier within the hospitality and care industries in the Asia-Pacific region. The company provides a variety of essential items, including kitchen equipment, tableware, and consumables. The organization maintains a significant operational footprint, operating through 26 different locations across Australia.

Risk assessment and potential impact

The alleged breach of Reward Hospitality poses several significant risks. The presence of personal identification information and Employee Tax File Numbers (TFN) in the leaked data could lead to serious consequences for the individuals involved. Specifically, this type of data exposure increases the risk of identity theft and makes employees and customers targets for highly personalized and sophisticated phishing attacks.

Furthermore, the exposure of such sensitive information may result in compliance issues under Australian privacy laws. Organizations handling large amounts of personal and financial data are subject to strict regulatory frameworks designed to protect consumer privacy; a breach of this nature often triggers legal and regulatory scrutiny.

The BlackSuit group is assessed to be a successor to the Royal ransomware operation. This connection suggests that the group likely possesses significant attack capabilities and sophisticated methodologies. The impact on Reward Hospitality could manifest as a disruption to operational continuity and damage to its commercial reputation. Additionally, there is a possibility that the leaked data could be utilized by the attackers for secondary extortion methods in the future.

In the hospitality and supply sectors, organizations often face risks from such targeted attacks. To mitigate these threats, companies typically focus on robust defensive measures. These include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, maintaining offline, immutable backups and implementing strict network segmentation can help limit the movement of attackers and ensure that data can be recovered in the event of an incident.