Stormous ransomware group lists calcomp.co.th on its leak site

• Ransomware group: Stormous
• Country: Thailand
• Sector: Manufacturing
• Announcement date: February 14, 2024

Stormous claims data breach at Cal-Comp Electronics

The Stormous ransomware group has listed the Thailand-based manufacturing company calcomp.co.th on their leak site, alleging a data breach. This announcement, made on February 14, 2024, marks a new instance of the group targeting industrial entities within the region.

The group claims to have compromised the entity and alleges that data belonging to the institution has been exfiltrated. According to the announcement, the attack was claimed to have occurred on February 14, 2024. However, the group has not provided any specific information regarding a ransom demand or the volume of the compromised data. Furthermore, there is no information available regarding the nature of the leaked or threatened data, and no screenshot has been provided to support the claim.

Details of the alleged incident

In the current landscape of cyber threats, ransomware groups often utilize leak sites to exert pressure on their victims. These sites serve as a public platform where groups post the names of compromised organizations, often accompanied by claims of data theft. This tactic is frequently associated with double extortion, where attackers not only encrypt an organization's systems but also threaten to release sensitive information to the public or its clients to force payment.

In this specific case, the Stormous group has posted the listing, but the details remain sparse. The listing names no specific data types that have been compromised. The lack of evidence, such as screenshots or a detailed inventory of stolen files, is a common occurrence in early-stage leak site announcements, where the primary goal is often to signal that a breach has occurred rather than to provide a full forensic report.

About Cal-Comp Electronics

Cal-Comp Electronics is a major player in the global supply chain. The company is the largest Electronics Manufacturing Services (EMS) company in Thailand and Southeast Asia. It provides a wide range of services to clients worldwide, including original equipment manufacturing (OEM) and original design manufacturing (ODM) services.

Risk assessment and industry implications

This situation may pose risks to the institution's operational continuity and data privacy. Given the Stormous group's history of politically motivated actions, the potential public release of data could damage the institution's reputation. Depending on the nature of the data, secondary risks such as identity theft or targeted phishing attacks against customers and business partners may arise.

The group's past methods suggest that they use data leaks as a pressure tactic. Information about this group remains limited, which adds a layer of uncertainty to the incident. For organizations operating in the manufacturing sector, such threats highlight the importance of robust cybersecurity frameworks. Defensive strategies typically involve implementing multi-factor authentication, maintaining rigorous patch management protocols, and ensuring comprehensive offline backups are available to mitigate the impact of encryption-based attacks.

Furthermore, manufacturing entities must prioritize the protection of intellectual property and sensitive client data to maintain trust within the global OEM and ODM markets. Monitoring for unauthorized data exfiltration and enhancing network segmentation are also critical steps for organizations looking to defend against the types of tactics employed by groups like Stormous. As these groups continue to use data leaks as a tool for leverage, the ability to respond quickly to potential breaches remains a vital component of institutional resilience.