Royal ransomware group lists Grange Packing Solutions on leak site

• Ransomware group: Royal
• Country: United Kingdom
• Sector: Manufacturing
• Announcement date: May 26, 2023

Royal ransomware group claims breach of Grange Packing Solutions

The Royal ransomware group has listed the United Kingdom-based organization Grange Packing Solutions on its dedicated leak site. In the announcement, the threat actors claim to have successfully exfiltrated a significant amount of data from the company's internal systems.

This incident follows a common pattern in modern cyberattacks known as double extortion. In such scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also focus on stealing sensitive information. The goal of this tactic is to pressure the victim into paying a ransom by threatening to leak the stolen data publicly, which can lead to severe reputational and legal consequences.

Details of the alleged attack

According to the announcement posted on May 26, 2023, the Royal group claims to have targeted the organization on the same day. The threat actors assert that they have downloaded a total of 3 GB of data from the systems belonging to Grange Packing Solutions. In addition to the claim regarding the volume of data, the group included specific details regarding the organization's operations and its internal structure within their public announcement.

While the group has provided information regarding the operational scale of the company, they have not provided specific details regarding the actual content of the allegedly exfiltrated data, other than the total size of 3 GB. The listing does not specify the file types or the specific nature of the documents that were supposedly taken during the intrusion.

Organization profile

Grange Packing Solutions is a manufacturing company that specializes in the production of plastic packaging goods and machinery. The company has been part of the Speciality Consortium since its acquisition in 2021.

Risk assessment and industry implications

The Royal group is a threat actor that emerged in 2022 and is assessed to have ties to the Conti ransomware group. It has been reported that the group has continued its operations under the name BlackSuit as of 2023. The alleged data breach involving Grange Packing Solutions may result in legal obligations under the UK GDPR, as the exposure of data can trigger regulatory scrutiny and mandatory reporting requirements.

The potential exposure of data could lead to various secondary risks. These include the possibility of identity theft or the execution of targeted phishing attacks directed at the organization's employees and business partners. For a company operating within the manufacturing sector, such an incident may cause significant operational disruptions and lead to lasting damage to its commercial reputation.

To defend against such threats, organizations in the manufacturing sector often implement various defensive measures. These include maintaining robust backup solutions, implementing multi-factor authentication across all remote access points, and conducting regular security awareness training for employees to recognize phishing attempts. Furthermore, network segmentation can help prevent attackers from moving laterally through a production environment once they have gained initial access.

Summary of the claim

• Threat Actor: Royal
• Target: Grange Packing Solutions
• Claimed Data Size: 3 GB
• Announcement Date: May 26, 2023