South American Tours listed on meow ransomware leak site

• Ransomware group: meow
• Country: Peru
• Sector: Hospitality
• Announcement date: August 26, 2024

The meow ransomware group claims a data breach at South American Tours

The travel company South American Tours has been listed on the leak site of the ransomware group known as meow. According to the announcement made by the threat actors, the group claims to have obtained approximately 350 MB of data belonging to the organization.

The incident was announced on August 26, 2024, which aligns with the date the group claims the attack took place. This type of activity is characteristic of modern ransomware operations, where attackers often employ double extortion tactics. In these scenarios, threat actors not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive data to use as leverage, threatening to publish it on public leak sites if a ransom is not paid.

The meow group has published the data they claim belongs to South American Tours on their leak portal. The group is demanding a payment of 16,000 USD for exclusive access to the stolen information or 8,000 USD for access by multiple parties. The announcement alleges that the stolen data includes confidential information regarding the company's operational processes.

Alleged contents of the leaked data

The information allegedly exfiltrated by the meow group is said to be quite diverse, covering various aspects of the company's internal and external operations. The group claims that the leaked data includes the following types of information:

• Employee data
• Client information
• Scanned payment documents
• Personal data (including sensitive information)
• Medical referral documents

The inclusion of such varied data types suggests a broad compromise of the organization's digital environment, potentially affecting both the internal workforce and the external customer base.

About South American Tours

South American Tours is a specialized travel company that offers immersive and custom-tailored travel experiences across South America. They provide services in areas such as adventure, culture, nature, and luxury travel, utilizing local expertise and a network of guides.

Potential risks and organizational implications

This alleged data leak may pose significant risks, such as identity theft and targeted phishing attacks, for the company's employees and customers. The presence of medical referral documents and sensitive personal data may lead to legal consequences for the organization under data privacy regulations. Furthermore, the group's specific ransom demands—offering different price points for exclusivity versus multiple access—may increase the likelihood of the data being sold on secondary markets, which could further damage the company's commercial reputation.

Publicly available information regarding the meow group remains limited, making it difficult to attribute these actions to a specific known threat actor profile. For organizations facing similar threats, it is generally advisable to conduct a thorough forensic investigation to determine the full scope of the leaked data and identify the initial entry point used by the attackers.

In the broader context of cybersecurity, such incidents highlight the importance of robust defensive measures. Organizations in the hospitality and travel sectors often handle significant amounts of personally identifiable information (PII), making them attractive targets for cybercriminals. Common defensive strategies include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to prevent phishing-related breaches. When a breach is suspected, rapid incident response and transparent communication with affected parties are critical components of managing the fallout and mitigating long-term damage.