Stockmann Natursteine & Fliesen targeted by Nokoyawa ransomware

• Ransomware group: Nokoyawa
• Country: Germany
• Sector: Manufacturing
• Announcement date: May 23, 2023

The Nokoyawa ransomware group has announced a data breach involving the German company Stockmann Natursteine & Fliesen. According to a post on the group's leak site, the attackers claim to have exfiltrated a significant volume of sensitive information belonging to the organization.

The alleged cyberattack

The Nokoyawa group claims to have successfully compromised the data belonging to Stockmann Natursteine & Fliesen. According to the announcement made on May 23, 2023, the group asserts that they gained unauthorized access to various internal resources. Specifically, the attackers claim to have accessed the company's projects, accounting records, and user desktop data. While the group has published a leak announcement, public information regarding the specific identity and operational details of the Nokoyawa group remains limited.

Ransomware attacks of this nature often follow a pattern known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The threat of leaking this stolen information on a public leak site serves as additional leverage to pressure the victim into paying a ransom. By publishing a claim of theft, the group aims to damage the victim's reputation and create legal or regulatory pressure.

Data involved in the leak

The claim made by the Nokoyawa group suggests a substantial volume of stolen information. The group alleges that the leak contains approximately 190 GB of data. This data is said to include a variety of sensitive files that could impact both the company's operations and the privacy of individuals. The specific types of data mentioned in the claim include:

• Accounting reports
• Personal data
• Passport copies
• Project files

The presence of such diverse data types, particularly personal identifiers and financial documentation, highlights the potential impact of the breach. When attackers gain access to user desktop data and accounting records, they often find a mix of corporate intellectual property and highly sensitive personal information belonging to employees or clients.

About Stockmann Natursteine & Fliesen

Stockmann Natursteine & Fliesen is a business based in Laupheim, Germany. The company specializes in natural stone and tiling services, providing expertise in stone masonry and ceramic installation. With over 30 years of experience, they serve both residential and commercial projects through their specialized construction and masonry services.

Potential impact and risks

The alleged leak of 190 GB of data poses several significant risks. For the company, the publication of such information may have negative implications for its commercial reputation. Furthermore, because the organization is based in Germany, the leaked data may fall under the scope of the European Union's General Data Protection Regulation (GDPR), which imposes strict requirements on the protection of personal data and the notification of breaches.

For the individuals whose data was allegedly stolen, there is a heightened risk of identity theft. The inclusion of passport copies and personal information in the leak provides malicious actors with the necessary tools to impersonate victims. Additionally, the company may face secondary risks, such as targeted phishing attacks, where attackers use the stolen information to craft highly convincing messages to deceive employees or customers. To defend against such threats, organizations typically implement robust security measures, including multi-factor authentication, regular data backups, and comprehensive employee training to recognize social engineering attempts.