SKF.com allegedly targeted by Raznatovic ransomware group

• Ransomware group: Raznatovic
• Country: Sweden
• Sector: Manufacturing
• Announcement date: December 17, 2023

Raznatovic claims data leak involving SKF.com

The threat actor known as Raznatovic has announced the leak of approximately 50 GB of data allegedly belonging to SKF.com. This announcement, made on a ransomware leak site, suggests a significant breach targeting the Swedish multinational corporation.

According to the claims made by the threat actor, the Raznatovic group has listed data on their leak site that they claim belongs to SKF.com. The threat actor alleges that the organization did not meet their ransom demand, leading to the publication of the data. This scenario follows a common pattern in modern cyberattacks where extortionists use the threat of public exposure to pressure victims into paying a ransom.

Details of the claimed data breach

The announcement specifies that the leaked data includes specific types of information. While the total volume of the data is estimated to be approximately 50 GB, the specific content is categorized by the threat actor as follows:

• User information
• Chat logs

The group has not provided information regarding the specific file count or the exact amount of the ransom demand. The announcement type is classified as a data leak (veri_sızıntısı).

About SKF

SKF is a Swedish multinational company specializing in the design and manufacturing of bearings, seals, lubrication systems, and mechatronics. It provides critical components for industrial equipment and the automotive sector.

Analysis and potential implications

This incident may lead to the exposure of the organization's operational data and internal or customer communications. The leaked data could potentially be utilized for identity theft or targeted phishing attacks against the organization. Depending on the regions where the organization operates, legal processes under data protection regulations such as GDPR may be triggered.

Public information about this group is limited, and their methods remain uncertain. The use of the double extortion tactic—where attackers not only encrypt systems but also threaten to release sensitive data—can increase pressure on the organization and trigger secondary risks. In such cases, the risk shifts from mere operational downtime to long-term reputational and legal consequences.

When organizations face these types of threats, common defensive steps often include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent phishing. However, once data has been leaked, the focus often shifts to incident response, forensic investigation, and compliance with regional data protection laws to mitigate the impact of the exposure.