Stormous ransomware group claims data breach against cmr24.by

• Ransomware group: Stormous
• Country: Belarus
• Sector: Financial Services
• Announcement date: February 8, 2025

Stormous claims to have leaked data from cmr24.by

The Stormous ransomware group has announced the publication of data allegedly belonging to cmr24.by on their leak site. According to the announcement made on February 8, 2025, the group claims to have targeted the organization and has already released a portion of the stolen information. The group alleges that they have successfully obtained the institution's financial data and operational documents during their attack.

This incident follows a pattern often seen in modern cyberattacks involving ransomware groups. Many such groups employ a tactic known as double extortion, where they not only encrypt an organization's systems to disrupt operations but also steal sensitive information. The threat of leaking this data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. In this specific case, the group has posted a notice claiming the breach occurred on February 8, 2025, though no ransom demand information has been provided in the announcement.

Details of the allegedly leaked information

The Stormous group claims that the breach involves a significant volume of information, specifically alleging that 5GB of data has been leaked. While the group has published a notice regarding the breach, no screenshots of the stolen data have been made available to verify the claims. The content of the alleged leak is described as containing various sensitive documents related to the organization's business activities and client interactions.

The data allegedly included in the leak consists of the following items:

• Account statements
• Payment checks
• Customer data
• Invoices
• Operational reports
• Logistical documents

The presence of such diverse documentation suggests a deep penetration into the organization's internal filing systems, potentially touching upon both financial and logistical workflows.

About cmr24.by

CMR24 is a financial services and payment systems provider based in Belarus. The company operates in the field of various financial transactions and payment solutions, making it a critical component of the regional financial infrastructure. Given its role in processing transactions and managing payment solutions, the organization handles a wide array of sensitive financial and operational information.

Impact and security implications

This alleged leak may increase the risk of identity theft and fraud for the institution's customers. Because the leaked data is of a highly sensitive financial nature, the breach could lead to significant reputational damage and may trigger investigations by regulatory authorities. The misuse of the relevant data by third parties could also negatively impact supply chain security, as the information could be used to facilitate further attacks against partners or clients of the organization.

The Stormous group is known as an entity that claims to be politically motivated and uses data leaks as a tool. Such groups often target high-value sectors to maximize the impact of their disclosures. For organizations in the financial services sector, this incident highlights the critical importance of robust data security processes. A potential lack of sufficient security measures can create a basis for the recurrence of similar attacks in the future.

To mitigate such risks, organizations typically focus on implementing comprehensive defensive strategies. These include maintaining strict access controls to ensure that only authorized personnel can reach sensitive financial and logistical documents. Additionally, regular auditing of security protocols and the implementation of advanced monitoring tools can help detect unauthorized access before large volumes of data can be exfiltrated. Protecting the integrity of the supply chain also requires rigorous third-party risk management to ensure that a breach in one entity does not cascade through the broader financial ecosystem.