Schandy allegedly targeted by avoslocker ransomware group

• Ransomware group: avoslocker
• Sector: Professional Services
• Announcement date: February 11, 2023

Avoslocker claims to have compromised Schandy data

The ransomware group known as avoslocker has claimed responsibility for a data breach involving the organization Schandy. According to an announcement made on the group's leak site, the attackers claim to have successfully compromised sensitive information belonging to the entity. This type of announcement is a common tactic used by ransomware actors in what is often referred to as double extortion, where stolen data is used as leverage to pressure victims into paying a ransom.

The group's announcement was posted on February 11, 2023. The threat actors claim that the data in their possession was obtained on the same day, February 11, 2023. While the group has listed the stolen information on their leak site, they have not provided any screenshots to verify the contents of the alleged breach.

Details of the alleged data theft

The avoslocker group claims to be in possession of a significant volume of data, totaling over 100 GB. The group asserts that this collection includes various types of confidential files and sensitive employee records. The nature of the leaked information, as described by the attackers, suggests a focus on internal organizational documentation and personal identification details.

According to the claims made by the group, the stolen data includes the following items:

• Employee data
• CVs
• Passport information
• HR records
• Confidential files

It is important to note that the group has not provided a specific ransom demand in their announcement, and the exact file count remains unknown.

Impact and potential risks

The alleged leak of such sensitive information poses several significant risks to the organization and its stakeholders. The presence of passport information, CVs, and HR records in the hands of malicious actors significantly increases the risk of identity theft for the affected employees. Furthermore, the exposure of these details makes individuals within the organization more susceptible to targeted phishing attacks, where attackers use personal information to craft highly convincing fraudulent communications.

Because Schandy operates within the professional services sector, there is a possibility that client data may also be at risk, although the group's specific claims focus on employee and confidential files. Such a breach can lead to substantial reputational damage and may result in legal consequences for the organization. Additionally, the publication of this data could create challenges regarding compliance with regional data protection regulations, as organizations are often required to report such incidents to regulatory bodies.

General defensive considerations

While information regarding the specific capabilities and history of the avoslocker group remains limited, ransomware attacks of this nature highlight the importance of robust cybersecurity frameworks. Organizations typically focus on implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular employee security awareness training to mitigate these risks. Defending against double extortion requires a comprehensive approach to both perimeter security and internal data governance to prevent unauthorized access and exfiltration.