SKF.com targeted by Ransomed ransomware group

• Ransomware group: Ransomed
• Country: Sweden
• Sector: Manufacturing
• Announcement date: September 3, 2023

Ransomed group claims data breach at SKF.com

The threat actor known as Ransomed has announced a significant data breach involving the Swedish multinational industrial company SKF.com. According to an announcement made on a leak site on September 3, 2023, the group claims to have exfiltrated 2.19 terabytes of data allegedly belonging to the organization. The group has asserted that the attack occurred on the same day the announcement was posted.

This incident follows a common pattern in modern cybercrime where threat actors utilize leak sites to pressure victims. These sites serve as public bulletin boards where attackers post details about their targets, the volume of stolen data, and demands for payment. Such tactics are designed to maximize the visibility of the breach and increase the psychological pressure on the victimized organization.

The claims of the Ransomed group

The Ransomed group has provided specific details regarding the nature of the intrusion. The threat actor claims that the SKF.com network was compromised through a collaborative effort with the Everest Ransomware Group. This suggests a level of coordination between different cybercriminal entities, a trend that has become increasingly common in the ransomware ecosystem.

The attackers have expressed frustration with the target, stating that the company has remained silent regarding the incident. As a result of this perceived lack of communication, the group has issued a threat to communicate with the company's competitors if contact is not established. This move is a classic example of double extortion, a tactic where attackers not only encrypt a victim's systems but also threaten to release sensitive information to damage the company's market position and reputation.

In terms of financial demands, the group has reportedly requested a ransom payment of $100,000 to prevent the further dissemination of the stolen information.

Alleged data types and contents

While the group has not provided any screenshots to verify their claims, they have specified the types of information that were allegedly stolen during the breach. The volume of the data is reported to be 2.19 terabytes, though the specific number of files involved has not been disclosed. The contents of the alleged leak include:

• Internal documents
• Databases
• Customer information

The exposure of such diverse data types—ranging from internal corporate documentation to sensitive customer information—presents a significant risk to the integrity of the organization's operations and its relationship with its clients.

About SKF

SKF is a Swedish multinational industrial company specializing in the design and manufacturing of bearings, seals, lubrication systems, and mechatronics. It provides engineering solutions for industrial equipment worldwide.

Potential impact and organizational risks

The claims made by Ransomed suggest several critical risks for the organization. This incident may negatively impact the operational continuity and commercial reputation of the company. The potential exposure of customer data could lead to legal sanctions and administrative fines under relevant data protection regulations. Furthermore, the threat of communicating with competitors via double extortion tactics may increase secondary risks and the loss of competitive advantage.

Beyond the immediate reputational damage, the leaked data could be utilized by malicious actors for identity theft or targeted phishing attacks. When sensitive internal documents and databases are leaked, it provides a roadmap for future, more targeted social engineering campaigns against employees or partners.

In the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Organizations in this sector can take several defensive steps to mitigate these risks, such as implementing strict access controls, maintaining offline backups, and conducting regular security awareness training for employees. Given that information regarding the Ransomed group is limited, organizations must remain vigilant against the evolving tactics used by such entities.