Sabre Corporation allegedly targeted by Dunghill ransomware group

• Ransomware group: Dunghill
• Country: United States
• Sector: Transportation
• Announcement date: September 6, 2023

A massive data leak claim against Sabre Corporation

The threat actor known as Dunghill has announced a significant data leak allegedly belonging to Sabre Corporation. According to the claim made by the group, they have successfully exfiltrated a massive volume of information from the organization's systems. This announcement, made on a ransomware leak site, suggests a major security incident involving one of the key players in the global travel technology sector.

The group's claim involves a substantial amount of data, which is said to reach a total size of 1300 GB. While the group has made this public announcement, specific details regarding their identity and operational history remain limited in the public domain. This lack of information is common in the landscape of modern ransomware groups, which often operate with a degree of anonymity to evade law enforcement and security researchers.

Details of the alleged data theft

The Dunghill group published their announcement on September 6, 2023, asserting that they have obtained a wide variety of sensitive information. The scope of the alleged theft is broad, covering various aspects of the organization's business operations and internal administrative data. The information claimed to be stolen includes a diverse range of sensitive records that could impact multiple stakeholders.

The allegedly leaked data includes the following categories of information:

• Ticket sales databases
• Passenger turnover records
• Client data
• Passport scans
• Employee personal information
• Insurance numbers
• Salary tables
• Bank account details
• Balance sheet data

The presence of such diverse data types—ranging from financial records to highly sensitive identity documents like passport scans—indicates the potential depth of the unauthorized access claimed by the attackers.

About Sabre Corporation

Sabre Corporation is a leading software and technology company for the global travel industry. The organization plays a critical role in the ecosystem by developing reservation, distribution, and operational management systems. These technologies are essential for the daily functions of airlines, hotels, and travel agencies worldwide, making the company a central hub for travel-related data processing.

Potential impact and industry implications

This alleged leak may pose significant risks, such as identity theft and targeted phishing attacks, for both employees and clients. Given the sensitive nature of the leaked information, including passport scans and financial details, the data could be utilized for secondary fraudulent activities. Furthermore, the breadth of the data involved suggests that the incident might lead to compliance issues under relevant data protection regulations, especially considering the organization's extensive data processing activities.

The method used by the group—publishing stolen data on a leak site—may indicate a potential double-extortion strategy. In such scenarios, threat actors not only encrypt an organization's systems but also threaten to release sensitive data to pressure the victim into paying a ransom. This tactic significantly increases the pressure on organizations to comply with demands to avoid public exposure and regulatory penalties.

The potential impact on the organization's operational processes could be broad due to the sensitivity of the leaked information. For companies operating in the transportation and travel technology sector, maintaining the integrity and confidentiality of passenger and client data is paramount. Organizations in this sector can take various defensive steps to mitigate such risks, such as implementing robust encryption for data at rest and in transit, enforcing strict multi-factor authentication across all systems, and maintaining rigorous monitoring of network traffic to detect unauthorized data exfiltration early.