Sonae targeted by RansomEXX in alleged data breach

• Ransomware group: RansomEXX
• Country: Portugal
• Sector: Retail & E-Commerce
• Announcement date: April 5, 2022

The RansomEXX ransomware group has claimed to have leaked a significant volume of data belonging to Sonae, a major multinational conglomerate based in Portugal. According to an announcement made on the group's leak site on April 5, 2022, the attackers claim to have successfully exfiltrated and published sensitive information related to the organization's operations.

Details of the alleged leak

The RansomEXX group claims to have listed data belonging to Sonae on their dedicated leak site and made it public. According to the group's announcement, the stolen data is organized into 56 separate parts, totaling approximately 27.02 GB in size. To facilitate the distribution of this information, the group claims that the data is accessible to the public and has provided a download link along with a password for users to access the files.

While the group has made these claims publicly, it is important to note that the information is based on the group's own assertions. Ransomware groups often use leak sites to host stolen data as a method of psychological warfare and extortion. In these scenarios, the group typically employs a tactic known as double extortion. In a double extortion scheme, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data and threaten to release it publicly unless a ransom is paid. This increases the pressure on the victim, as the threat of a data leak can lead to regulatory penalties and reputational damage even if the organization can restore its systems from backups.

Content of the allegedly leaked data

Based on visible sample file content from screenshots provided by the group, the leaked material appears to include operational data related to logistics and inventory management. This includes specific details that are vital to the day-to-day running of a large-scale commercial operation. The data reportedly includes:

• Logistics data
• Inventory records
• Address information
• Product codes

The presence of such data suggests that the breach may impact the integrity of the organization's supply chain and operational workflows.

About Sonae

Sonae is a multinational Portuguese conglomerate that maintains a significant presence across various sectors. The organization operates in diverse fields including food retail, shopping centers, telecommunications, and technology. As one of the leading retail groups in Europe, Sonae manages an extensive network of stores and various business units, making it a major player in the regional and international market.

Impact and organizational risks

The content of the allegedly leaked data may contain sensitive information regarding the institution's operational processes and supply chain management. Such a leak can lead to various complications, including potential disruptions in the institution's commercial activities. Furthermore, the exposure of this information could create secondary risks for third-party business partners who interact with the organization's logistics and inventory systems.

From a regulatory perspective, the public availability of such data may trigger compliance issues under data protection regulations in the various regions where the institution operates. Organizations facing such threats must navigate complex legal landscapes regarding mandatory breach notifications and consumer rights. Information regarding the RansomEXX group remains limited, though their use of double-extortion tactics is a notable characteristic of their operations.

For organizations operating in the retail and e-commerce sectors, maintaining robust cybersecurity posture is essential to mitigate these risks. General defensive steps often include implementing strict access controls, ensuring comprehensive encryption for data at rest and in transit, and maintaining rigorous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, regular security audits and employee training on phishing and social engineering can help reduce the likelihood of an initial breach that leads to such large-scale data leaks.