Roosens Bétons targeted by qilin ransomware group

• Ransomware group: qilin
• Country: Belgium
• Sector: Professional Services
• Announcement date: February 13, 2024

The qilin ransomware group claims a breach at Roosens Bétons

The threat actor known as qilin has claimed responsibility for a cyberattack targeting Roosens Bétons. According to an announcement posted on the group's leak site on February 13, 2024, the organization's data has been compromised. The group alleges that they have successfully exfiltrated information and have threatened to release the stolen data to the public.

Details of the alleged attack

According to the claims made by the qilin group, the breach occurred earlier in the year, specifically on January 11, 2024. The threat actor asserts that they have listed data belonging to Roosens Bétons on their dedicated leak site. This type of announcement is a common tactic used by ransomware groups to pressure victims into meeting their demands.

While the group has publicly claimed to have compromised the institution's data, there are currently no details or screenshots available regarding the specific nature of the allegedly leaked data. No information has been provided concerning the total volume of files, the specific file count, or the specific amount of the ransom demand requested by the attackers.

About Roosens Bétons

Roosens Bétons is a Belgian family-owned company with over 115 years of experience. The organization specializes in the development and production of concrete building materials. Producing 500,000 tonnes of concrete annually, the company offers a wide range of products ranging from foundations to finishing works.

Impact assessment and industry implications

This incident may negatively impact the institution's operational continuity and commercial reputation. Because the organization is based in Belgium, the incident may require investigation by data protection authorities under the General Data Protection Regulation (GDPR).

The listing names no specific data types as being affected. However, until the content of the data is clarified, the possibility of employee or customer information being leaked should be considered. Given that the qilin group is known to employ double-extortion tactics, there may be a risk that the leaked data could be used for secondary attacks or identity theft. In double-extortion schemes, attackers not only encrypt a company's systems but also steal sensitive data to use as leverage, threatening to publish it if the ransom is not paid.

Based on the group's past activities, there is a possibility that the data could be fully released if the institution does not pay the ransom. Organizations in the professional services and industrial sectors often face significant risks from such attacks, which can disrupt supply chains and erode trust with clients. General defensive steps for organizations facing these threats typically include maintaining robust backup strategies, implementing strict access controls, and ensuring continuous monitoring of network environments to detect unauthorized exfiltration early.