Safefood listed by Meow ransomware group

• Ransomware group: Meow
• Country: Ireland
• Sector: Agriculture and Food Production
• Announcement date: August 13, 2024

Meow ransomware group claims data breach at Safefood

The threat actor known as Meow has listed the Irish organization Safefood on its dedicated leak site. According to the announcement, the group claims to be in possession of a significant volume of confidential data belonging to the entity, marking a potential security incident for the food safety organization.

Details of the claimed attack

On August 13, 2024, the Meow group published a data leak announcement specifically targeting Safefood. The threat actor claims to have successfully exfiltrated a dataset totaling 200 GB, which allegedly contains various pieces of operational and confidential information belonging to the organization. The timing of the announcement coincides with the claimed date of the attack.

The group has outlined specific financial terms for the acquisition of the stolen information. The announcement states that the data is being offered for sale at a price of 8000 USD for a single buyer. Alternatively, the group has offered a lower price of 3000 USD if the data is sold to multiple buyers. This tactic is characteristic of modern ransomware operations where threat actors attempt to maximize profit through different sales models.

Scope of the leaked information

The announcement included a screenshot intended to provide evidence of the breach. Based on the visual evidence provided by the group, the leaked data is claimed to include a variety of sensitive categories. The information allegedly compromised includes:

• Employee data
• Client information
• Document scans
• Financial records

Furthermore, the provided screenshot displays samples of various certificates and official documents, suggesting that the breach may involve sensitive administrative or legal paperwork.

About Safefood

Safefood is a public body established to promote food safety and healthy eating on the island of Ireland. The organization conducts research and runs public awareness campaigns designed to prevent foodborne diseases and improve public health across the region.

Risk assessment and implications

If the claims made by the Meow group are verified, it is assessed that employees and associated parties of Safefood may face significant risks of identity theft due to the exposure of personal information. As an organization based in Ireland, the incident may require investigation by data protection authorities under the General Data Protection Regulation (GDPR) framework.

The exposure of corporate financial data and personal information could lead to substantial reputational damage and operational disruptions for the entity. While public information regarding the Meow group remains limited, their ransom demand and data sale tactics suggest that the group is primarily motivated by financial gain. Additionally, there is a secondary risk that the leaked data could potentially be utilized in targeted phishing campaigns against the organization or its stakeholders.

In such scenarios, organizations often face the challenges of double extortion, where attackers not only encrypt systems but also threaten to release sensitive data to pressure the victim into paying. To defend against such threats, organizations typically focus on robust data encryption, strict access controls, and continuous monitoring of their networks to detect unauthorized data exfiltration. Maintaining regular, offline backups and conducting regular security awareness training are also standard defensive measures used to mitigate the impact of ransomware and data leaks.