Shaghalni listed on killsec ransomware leak site

• Ransomware group: killsec
• Country: Egypt
• Sector: Retail & E-Commerce
• Announcement date: February 23, 2025

The killsec ransomware group claims a breach of Shaghalni

The Egypt-based job search platform Shaghalni has been listed on the killsec ransomware group's leak site. According to the announcement, the threat actor claims to have accessed data belonging to the platform and has posted an advertisement on their dedicated leak site to facilitate the extortion process.

The threat actor is demanding a ransom of 5,000 EUR for the sale of the data. This announcement was officially created on February 23, 2025. In line with common ransomware extortion tactics, the group provides a communication channel intended for negotiations with company representatives to resolve the matter.

Ransomware groups often employ a strategy known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The threat actors then threaten to leak this stolen data on public or private leak sites if the ransom is not paid. This adds significant pressure on the victim, as the threat of a data leak can lead to severe reputational damage and legal consequences, even if the organization can restore its systems from backups.

Alleged data types and evidence provided

The listing provided by the killsec group includes evidence to support their claims. The screenshots shared by the group display examples of official Egyptian government documents and identification-like records being shared as proof of the breach.

The data allegedly involved in this incident includes:

• Personal identification data
• Official documents

The exposure of such sensitive information, particularly official government documents and identification records, significantly increases the risk of the data being misused by malicious actors for purposes such as identity theft or highly targeted phishing attacks.

About Shaghalni

Shaghalni is an Egypt-based online job portal and recruitment platform. It operates as a digital career site designed to connect both blue-collar and white-collar workers with potential employers.

Analysis and potential impact

The alleged leak may pose a significant risk of exposing the personal data of job seekers who are registered on the platform. Because the platform serves as a bridge between workers and employers, the sensitivity of the information handled is high. Consequently, the company could face legal liabilities under Egypt's Personal Data Protection Law due to the potential exposure of user information.

Public information regarding the killsec group remains limited. However, the group's ransom-oriented activities may increase the risk of the stolen data being sold on secondary markets. When data is leaked to these markets, it can be acquired by various malicious actors, further extending the lifecycle of the breach and the potential for subsequent attacks against the individuals involved.

In such situations, organizations typically need to undergo a thorough review of their data security processes to identify vulnerabilities that may have been exploited. Furthermore, notifying the affected users is a critical step to allow them to take protective measures, such as monitoring their financial accounts or changing credentials, to mitigate the impact of potential identity theft or phishing attempts.