SOLEIL listed on fog ransomware leak site

• Ransomware group: fog
• Country: France
• Sector: Government & Defense
• Announcement date: February 4, 2025

French synchrotron facility SOLEIL targeted by fog group

The French national synchrotron radiation facility, SOLEIL, has been listed on the leak site of the threat group known as fog. According to an announcement published by the group on February 4, 2025, the organization's data has been compromised. The threat actor claims to have gained unauthorized access to the organization's Gitlab repositories, and the process of exfiltrating or publishing this data was announced via the group's own platform.

Details of the claimed breach

The threat group fog claims that the security breach occurred on February 4, 2025. In their announcement, the group alleges that they have successfully accessed sensitive internal resources. Specifically, the group's post states that Gitlab source codes belonging to SOLEIL have been leaked. To support their claim, the group provided a screenshot that references a torrent file with a size of 5 GB.

While the group has made these claims regarding the exfiltration of data, no specific information was provided regarding the exact ransom demand or the total volume of data stolen beyond the mentioned torrent file. The group's identity and specific operational details remain limited in the public domain.

Affected data types

• Source codes

About SOLEIL

SOLEIL is a national synchrotron radiation facility located in France. The institution utilizes particle accelerator technology to conduct advanced research across various scientific disciplines. Its work is fundamental to several fields, including biology, materials science, and the fundamental sciences.

Potential impact and security implications

This incident may pose a significant risk to the organization's research data and intellectual property. The leakage of source code is particularly concerning as it could potentially be used by malicious actors to identify vulnerabilities within the organization's systems, which may facilitate secondary attacks. Given the highly specialized nature of the scientific work conducted at SOLEIL, the leak could potentially have a strategic impact.

Furthermore, as an organization operating within France, SOLEIL may face various data protection obligations under the General Data Protection Regulation (GDPR). In such scenarios, organizations often face the challenges of double extortion, a tactic where threat actors not only encrypt data but also threaten to leak it to pressure the victim into paying a ransom. This method increases the pressure on organizations to comply with demands to avoid public exposure of sensitive information.

To defend against such threats, organizations in the scientific and research sectors often implement defensive strategies such as robust access controls, multi-factor authentication, and continuous monitoring of repository access. Protecting intellectual property requires rigorous security protocols around development environments and source code management tools to prevent unauthorized exfiltration and ensure the integrity of scientific research.