Snatch ransomware group claims data leak involving US government and Rothschild & Rockefeller

• Ransomware group: Snatch
• Country: United States
• Sector: Government & Defense
• Announcement date: January 26, 2024

Snatch ransomware group claims data leak involving US government and Rothschild & Rockefeller

The Snatch ransomware group has announced a data leak on their dedicated leak site, claiming to have obtained private data belonging to the US government and Rothschild & Rockefeller. This announcement, posted on January 26, 2024, suggests a significant breach targeting sensitive information associated with these entities.

Details of the claimed attack

According to the announcement made by the threat actor known as Snatch, the group claims to have successfully infiltrated the targeted entities. The group stated that they have duplicated the alleged information and made it available on their Telegram channel. This method of using social messaging platforms to distribute stolen data is a common tactic used by modern ransomware groups to increase pressure on their victims.

The claim regarding the attack date points to January 25, 2024, one day prior to the public announcement on their leak site. While the group has asserted they have obtained the data, no specific details regarding the total volume of the data or the exact number of files involved have been provided in the announcement.

Information and data involved

The details provided by the group regarding the specific content of the leak are limited. There are no screenshots available to verify the contents of the files. The announcement primarily consists of lists of names referencing various high-level officials, which the group claims are part of the private data belonging to the entity.

• Names of various high-level officials

No specific data types or file formats were explicitly listed in the announcement beyond the mention of these names and the claim of private data belonging to the entity.

Ransomware trends and organizational risks

This incident highlights the evolving nature of ransomware operations. Many modern groups employ a double extortion strategy, where they not only encrypt an organization's systems but also steal sensitive data to threaten public disclosure. This approach increases the leverage the attackers hold over the victim, as the threat of a data leak can cause significant reputational and legal damage even if the organization can recover its systems from backups.

The Snatch group is known for specific technical behaviors, such as rebooting systems into safe mode to perform encryption. Such techniques are designed to bypass certain security measures and can significantly disrupt the operational continuity of an organization. The group has been active in the cyber threat landscape since 2018.

Potential impact and defensive considerations

The potential leak of sensitive information involving government entities and high-profile organizations carries severe risks. If the claimed data is indeed disclosed, it could lead to identity theft or highly targeted phishing attacks against the specific individuals mentioned in the lists. Furthermore, such breaches can lead to negative consequences for supply chain security and the overall corporate reputation of the affected entities.

From a regulatory perspective, the disclosure of sensitive information can create significant risks regarding data protection regulations. Organizations in the government and defense sector must prioritize robust security frameworks to mitigate these threats. Common defensive steps for organizations facing such risks include implementing strict access controls, maintaining offline backups, and conducting regular security audits to detect unauthorized access before data can be exfiltrated.