Service Avicole JGL listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: Canada
• Sector: Agriculture and Food Production
• Announcement date: November 23, 2024

Inc Ransom claims to have compromised Service Avicole JGL

The Inc Ransom ransomware group has officially listed the Canadian organization Service Avicole JGL on its dedicated leak site. According to the announcement made on November 23, 2024, the threat actor group claims to have successfully compromised the company's internal systems. This listing follows the group's pattern of claiming responsibility for cyberattacks and subsequently publishing information related to the victim to pressure the organization.

The group alleges that they have gained unauthorized access to the organization's network and have obtained various internal documents. To support their claims, the attackers have provided visual evidence in the form of screenshots. These images suggest that a variety of operational files have been exfiltrated from the company's infrastructure, indicating a significant breach of data confidentiality.

Details of the alleged data exfiltration

Based on the screenshots provided by the Inc Ransom group, the stolen information appears to be diverse, covering sensitive administrative, financial, and personal categories. The leaked samples include documentation related to the CSST (Quebec Health and Safety Board), which is a critical regulatory body in the region. Furthermore, the group claims to have accessed sensitive user credentials and various payment records.

The specific types of data identified in the leak include:

• Employee data
• Financial records
• Credit card information
• Health and safety documents

The presence of such sensitive information, particularly credit card details and employee-related documentation, highlights the potential severity of the breach. Such data is highly valued by malicious actors for various illicit purposes, ranging from identity theft to direct financial fraud.

About Service Avicole JGL

Service Avicole JGL is a company based in Quebec, Canada. The organization operates within the agriculture and food production sector, specifically focusing on the poultry industry. They provide a range of services and equipment tailored to this field, specializing in technical support and operational solutions designed to assist poultry farming operations.

Risk assessment and implications of the attack

The incident involving Service Avicole JGL highlights the growing threat of double-extortion tactics employed by modern ransomware groups. In a double-extortion scenario, attackers do not merely encrypt a victim's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak the data publicly, the group increases the pressure on the organization to meet their demands, as the exposure of such data can lead to severe reputational and legal consequences.

The exposure of the leaked information poses several significant risks. For the employees and business partners of Service Avicole JGL, the theft of personal and health and safety documents may lead to a heightened risk of identity theft. Additionally, the compromise of credit card and financial information directly threatens the organization's financial security and could facilitate secondary fraud attempts. Given the nature of the data, the group's past activities suggest that the stolen information could be utilized in highly targeted phishing campaigns aimed at the company's stakeholders.

From a regulatory perspective, the organization may face legal obligations under Canada's data protection legislation, specifically the Personal Information Protection and Electronic Documents Act (PIPEDA). Depending on the findings of an investigation, the organization may be required to fulfill mandatory data breach notification obligations to both regulators and the affected individuals.

Furthermore, the incident poses a direct risk to the organization's operational continuity. Ransomware attacks often cause significant disruptions to business processes, making it difficult for the company to maintain its standard level of service. To mitigate such risks, organizations in the agricultural and food production sectors should focus on robust defensive measures, such as implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to defend against the phishing attempts that often follow such breaches.