Softura claims data breach by incransom group

• Ransomware group: incransom
• Country: United States
• Sector: Technology
• Announcement date: May 9, 2024

The incransom ransomware group has claimed to have compromised data belonging to the technology company Softura. According to an announcement made on a leak site, the threat actor group alleges they have successfully targeted the organization, marking a significant potential breach for the technology firm.

Details of the claimed attack

The incident was reportedly carried out in late April, with the claimed attack date recorded as April 23, 2024. The announcement regarding this breach was subsequently posted on the incransom leak site on May 9, 2024. The group has stated that they possess a substantial amount of information and has threatened to publish the entire dataset if their ransom demands are not met.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In this method, attackers do not only encrypt a company's internal systems to disrupt operations but also steal sensitive data before the encryption occurs. By threatening to release this stolen information publicly, the attackers aim to increase the pressure on the victim to pay the ransom, leveraging the threat of reputational damage and regulatory scrutiny.

Data involved in the incident

The incransom group claims to have exfiltrated a significant volume of data from Softura. The specific details regarding the content of the leaked data remain unknown, as the group has not provided any screenshots or specific descriptions of the files involved. The listing names no specific data types.

• Claimed data size: 120 GB

While the volume of the data is specified, the lack of granular detail regarding the file types or the specific nature of the information makes it difficult to assess the immediate impact on specific business functions. However, the sheer scale of the claimed 120 GB dataset suggests a broad scope of the alleged compromise.

About Softura

Softura is a technology company that has been delivering projects using onshore and offshore software engineering teams for over 25 years. The firm is highly certified, holding both ISO 27001 and CMMI Level 3 certifications. Softura provides scalable software teams and access to a pool of expert talent for its clients, offering specialized software engineering services through its diverse workforce.

Implications and industry context

The involvement of a target with ISO 27001 and CMMI Level 3 certifications suggests that the breach could have negative implications for corporate processes and various client projects. Because Softura operates within the technology sector, a successful breach of this nature can lead to complex secondary risks. If sensitive client information or intellectual property is indeed part of the leaked data, it could potentially facilitate targeted phishing campaigns or even supply chain attacks against the company's partners and customers.

Furthermore, depending on the nature of the data and the jurisdiction, the company may face data breach notification obligations under relevant US state laws and federal regulations. Organizations in the technology sector often face heightened risks due to the sensitive nature of the intellectual property and client data they manage. To mitigate such risks, organizations typically focus on robust defensive measures, such as implementing strict access controls, maintaining comprehensive logging and monitoring, and conducting regular security audits to ensure compliance with international standards like ISO 27001.

The incransom group, which emerged in mid-2023, continues to be a notable actor in the ransomware landscape, utilizing these extortion-based tactics to target various organizations globally. The situation involving Softura highlights the ongoing challenge faced by technology providers to protect large-scale datasets from sophisticated threat actors.