Studio D.EL.LA. SRL listed on knight ransomware leak site

• Ransomware group: knight
• Country: Italy
• Sector: Professional Services
• Announcement date: November 20, 2023

The Italian-based professional services firm Studio D.EL.LA. SRL has been listed on a leak site associated with the ransomware group known as knight. The announcement, made on November 20, 2023, alleges that the organization has been targeted in a cyberattack, according to the group's claims.

The alleged data breach and claims by knight

The knight group claims to have successfully exfiltrated 150 GB of data belonging to Studio D.EL.LA. SRL. This alleged breach is claimed to have occurred on November 12, 2023. To support their claims, the group has shared sample files that appear to be related to the firm's core business activities, specifically focusing on payroll and data processing operations.

While the group has provided these samples to demonstrate the validity of their claim, information regarding the specific operational methods and the broader activities of the knight group remains limited. In many modern ransomware scenarios, groups utilize a tactic known as double extortion, where they not only encrypt an organization's systems but also threaten to leak sensitive information on a public leak site if a ransom is not paid. This pressure is designed to force compliance by leveraging the reputational and legal risks associated with data exposure.

Details of the potentially compromised data

The files shared by the attackers in their announcement provide a glimpse into the types of information they claim to have obtained. Based on the file names visible in the announcement, the data appears to be highly sensitive, involving personal and financial documentation. The provided screenshot from the leak site displays the security verification page, which is a common feature used by such groups to prove they have access to the target's infrastructure.

The information identified in the leaked samples includes:

• Identity documents
• Bank details
• Personnel data
• Payroll information

The presence of such data suggests that the breach could have significant implications for the individuals whose information is contained within the files. While the ransom demand has not been disclosed, the group's intent appears to be the full disclosure of the data if their demands are not met.

About Studio D.EL.LA. SRL

Studio D.EL.LA. SRL is a professional services firm based in Trieste, Italy. Established in 2014, the organization operates as a data processing and payroll management center. The firm provides a specialized range of services to its corporate clients, including the preparation of payroll, managing social security obligations, providing consulting on labor law, and handling various tax processes.

Risk assessment and industry implications

The alleged breach of Studio D.EL.LA. SRL poses significant risks, particularly regarding identity theft for both the firm's employees and its clients. Because the firm processes highly sensitive personal and financial information, the exposure of this data can lead to targeted phishing attacks and other forms of social engineering against the affected parties. Furthermore, the nature of the firm's work means that this incident could create secondary supply chain risks for the more than 200 companies that rely on Studio D.EL.LA. SRL for their payroll and tax management needs.

From a regulatory perspective, since the firm manages payroll and tax processes, it may face significant data breach notification obligations under the General Data Protection Regulation (GDPR). Organizations operating in the professional services sector, especially those handling third-party data, must prioritize robust security frameworks to mitigate these risks. Common defensive steps for such organizations include implementing multi-factor authentication, maintaining strict access controls, conducting regular security audits, and ensuring comprehensive employee training to recognize phishing attempts. Maintaining offline, encrypted backups is also a critical component of a resilient cybersecurity posture to defend against the encryption phase of ransomware attacks.