Tang Capital Management allegedly targeted by Ragnar Locker ransomware group

• Ransomware group: Ragnar Locker
• Country: United States
• Sector: Financial Services
• Announcement date: October 10, 2022

The Ragnar Locker ransomware group has claimed responsibility for a significant data breach involving Tang Capital Management, LLC. According to an announcement published on the group's leak site, a substantial volume of data has been exfiltrated and made public, targeting the financial services sector.

The details of the alleged attack

On October 10, 2022, the Ragnar Locker group listed a data leak on their dedicated leak site, claiming that the stolen information belongs to Tang Capital Management. The group has claimed that the total volume of the exfiltrated data amounts to 78 GB. In their announcement, the threat actors stated that they are publishing this information because the organization allegedly failed to address known security vulnerabilities.

This incident follows a pattern often observed with modern ransomware operations. Many groups now employ a "double extortion" tactic. In this method, attackers do not merely encrypt an organization's files to disrupt operations; they first exfiltrate sensitive data from the network. This allows them to threaten the victim with the public release of confidential information if a ransom is not paid, thereby increasing their leverage and pressure on the target organization.

The scope of the leaked data

The announcement provided by the Ragnar Locker group included various documents that are purportedly related to the operational and financial processes of Tang Capital Management. Based on screenshots provided as evidence in the leak site announcement, the stolen data is quite diverse and covers several critical business and personal categories.

The information allegedly exposed includes the following types of data:

• Bank account information
• Passport copies
• Employee employment contracts
• Clinical research reports
• Revenue spreadsheets
• Confidentiality agreements

The presence of such sensitive documentation suggests a deep penetration into the organization's file servers or cloud storage environments, allowing the attackers to access both corporate financial records and highly sensitive personal identification documents.

Implications and potential risks

The nature of the data allegedly leaked poses significant secondary risks to both the organization and the individuals involved. For employees and business partners, the exposure of passport copies and employment contracts significantly increases the risk of identity theft. Furthermore, the availability of bank statements and revenue spreadsheets can be used to facilitate highly targeted phishing attacks, as attackers can craft convincing messages based on the stolen financial context.

For the organization itself, the breach carries heavy implications. The exposure of clinical research reports could result in long-term consequences regarding the organization's intellectual property rights and its overall competitive advantage in the market. Additionally, because the organization is based in the United States, this breach may trigger mandatory data breach notification obligations under various state laws and federal regulations.

In the financial services sector, maintaining operational continuity and a strong commercial reputation is vital. The use of double extortion by groups like Ragnar Locker is specifically designed to damage that reputation and disrupt business processes. To defend against such threats, organizations in this sector typically focus on implementing robust security frameworks, such as multi-factor authentication, regular vulnerability scanning, and strict access controls to limit the movement of attackers within a network. Organizations are also encouraged to maintain offline backups and to monitor for unauthorized data exfiltration to detect such incidents before the data is posted to a leak site.

About the threat actor

Publicly available information regarding the Ragnar Locker group remains limited. However, the group is known to have operated using similar methods in the past, specifically utilizing the exfiltration of data prior to encryption to maximize their extortion capabilities.