Roper & Vertafore listed by Dunghill ransomware group

• Ransomware group: Dunghill
• Country: United States
• Sector: Technology
• Announcement date: September 26, 2023

Dunghill claims data breach at Roper & Vertafore

The threat actor known as Dunghill has published an announcement on their leak site claiming to have exfiltrated 2.2 TB of data belonging to Roper & Vertafore. This announcement, made on September 26, 2023, suggests a significant breach involving the organization's sensitive information. While the group has listed the company on their platform, information regarding this specific threat actor remains limited.

In modern cyberattack trends, ransomware groups often employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data before deploying the encryption. The threat of leaking this stolen information on a public leak site serves as additional leverage to pressure the victim into paying a ransom. Such actions aim to maximize the impact of the attack by threatening the victim's reputation and legal standing.

Details of the alleged exfiltration

According to the group's claims, the breach occurred on September 26, 2023. The Dunghill group alleges they have gained unauthorized access to the organization's corporate data, source codes, and client documentation. The scale of the alleged theft is substantial, with the group claiming a total data volume of 2.2 TB.

Based on screenshots provided by the attackers, the alleged leaked data includes a wide variety of sensitive information. The specific types of data mentioned in the claim include:

• Corporate data
• Marketing and project strategies
• Source codes (including AMS360 and Sagitta)
• Databases
• Confidential documents
• Business agreements
• Client documents
• Financial data
• HR information
• Emails

The inclusion of source code is particularly notable in cyberattacks, as it can provide a roadmap for further exploitation of software products.

About Vertafore

Vertafore is an insurance technology company that provides content management, workflow software, data analytics, and knowledge base solutions for insurance companies. Based in Denver, the firm develops software solutions that help participants in the insurance distribution channel scale their business processes and adapt to changes in the industry.

Potential impacts and industry implications

Given the volume and nature of the alleged leaked data, there may be significant impacts on the organization's operational continuity and commercial reputation. The exposure of client data and contracts could lead to a failure in meeting legal obligations and result in regulatory sanctions. Furthermore, the leakage of HR information and emails may create secondary risks such as identity theft or targeted phishing attacks for employees and clients.

The publication of source codes presents a specific technical risk, as it could facilitate the discovery of new vulnerabilities in the organization's software products and potentially lead to supply chain attacks. In a supply chain attack, attackers exploit a trusted third-party provider to gain access to its customers, potentially affecting a vast ecosystem of users.

Organizations operating in the technology and insurance sectors can take several defensive steps to mitigate these risks. Implementing robust data loss prevention (DLP) tools can help monitor and block unauthorized transfers of sensitive information. Strong access controls and the principle of least privilege ensure that users only have access to the data necessary for their specific roles, limiting the potential scope of a breach. Additionally, regular security audits and code reviews are essential for identifying vulnerabilities before they can be exploited by threat actors.

Summary of the incident

The incident involving Roper & Vertafore highlights the growing risks faced by technology providers that handle critical business processes for other industries. The claim by Dunghill involving 2.2 TB of data underscores the high stakes involved in modern ransomware operations where data exfiltration is a primary objective.