Scherr Legate listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Sector: Professional Services
• Announcement date: July 26, 2023

ALPHV claims data exfiltration against Scherr Legate

The ALPHV ransomware group, also known as BlackCat, has listed the professional services firm Scherr Legate on its dedicated leak site. According to the announcement made on July 26, 2023, the threat actors claim to have successfully exfiltrated a significant amount of internal data belonging to the organization. The group alleges that the breach occurred as early as February 8, 2022, though the public announcement of the theft was made much later.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. In these scenarios, attackers often employ a tactic known as double extortion. In a double extortion scheme, the threat actors do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption process begins. The attackers then threaten to publish this stolen data on their leak sites unless a ransom is paid, effectively using the threat of public exposure as leverage to coerce the victim into paying.

The claim made by ALPHV suggests a large-scale operation, with the group asserting that approximately 250 GB of data has been compromised. This volume of data indicates a substantial breach of the organization's digital environment, potentially involving a wide array of internal files and sensitive documentation.

Details of the alleged data breach

The threat actors have provided evidence to support their claims through the release of screenshots. These images reportedly display various directory structures that highlight the nature of the information they have accessed. The visual evidence suggests that the stolen data is highly sensitive and covers multiple administrative and client-related areas within the firm.

Based on the screenshots provided by the group, the compromised information includes several categories of highly sensitive data. The affected data types identified in the listing include:

• Employee data
• Customer data
• Bank account information
• Insurance records
• Accounting data

The presence of such diverse data types—ranging from individual client files to tax records and employee details—indicates that the breach may have touched upon almost every critical administrative function within the organization. The screenshots specifically point to the existence of directory structures containing accounting records, insurance documentation, and sensitive tax records (CPA), alongside individual client files and employee information.

Potential impact and risks

The alleged breach of Scherr Legate poses significant risks to both the organization and the individuals whose data has been targeted. For a firm operating within the professional services sector, the exposure of such sensitive information can have profound consequences. The loss of client confidentiality is a primary concern, as the breach could severely damage the firm's corporate reputation and the trust established with its clientele.

Furthermore, the specific nature of the exposed data—such as bank account details, insurance records, and employee personal information—creates immediate risks for the individuals involved. These individuals may face an increased threat of identity theft or become targets for highly specific, targeted phishing attacks. When attackers possess detailed knowledge of an individual's financial or professional life, they can craft much more convincing fraudulent communications.

From a regulatory perspective, the nature of the exposed data may trigger mandatory data breach notification requirements under applicable laws and regulations. Organizations are often legally obligated to inform both regulators and the affected individuals when sensitive personal or financial information has been compromised.

Security considerations for professional services

The ALPHV group is recognized in the threat intelligence community for its use of Rust-based malware. This technical characteristic is notable as Rust is a programming language often used by sophisticated actors to create efficient and harder-to-detect malicious software. Because ALPHV utilizes double-extortion tactics, there remains a persistent possibility that the exfiltrated data could be published across various platforms in the future, even if the initial leak site announcement is the only current evidence.

For organizations in the professional services sector, this incident highlights the critical importance of robust data protection strategies. Protecting against such threats typically involves implementing multi-layered security controls, such as strict access management, comprehensive encryption for data at rest and in transit, and continuous monitoring of network activity to detect unauthorized data exfiltration attempts. Maintaining rigorous backup protocols and incident response plans is also essential to mitigate the impact of such high-stakes cyberattacks.