Terralogic targeted in alleged data breach by secp0

• Ransomware group: secp0
• Country: United States
• Sector: Technology
• Announcement date: March 14, 2025

The threat actor group secp0 has announced a data breach involving Terralogic, claiming to have compromised the company's network. The announcement, made on a ransomware leak site, indicates a significant security incident involving the technology services provider.

Details of the alleged attack

According to the claims made by secp0, the group is publishing evidence of a network breach at Terralogic. The threat actor stated that this decision to release data is a result of a lack of cooperation from the organization. The group alleges that they have successfully infiltrated the network and harvested sensitive information from multiple internal sources.

The group claims to have extracted password hashes from Active Directory accounts, which are central to managing user identities and permissions within a network. Furthermore, the threat actor alleges that they have accessed and stolen data from the company's password manager. In addition to the data theft, the group claims to have carried out encryption operations on critical infrastructure components, specifically targeting Nutanix servers, Hyper-V servers, and backup devices.

Data and systems involved in the claim

The information allegedly exfiltrated by secp0 includes a variety of sensitive technical and organizational assets. The claims suggest that the breach impacts both internal authentication mechanisms and external-facing client information. The specific types of data and infrastructure mentioned in the announcement include:

• Password hashes
• Password manager data
• Server infrastructure data
• Client network data

While the group has claimed to have encrypted several systems, including Nutanix and Hyper-V servers as well as backup devices, the specific volume of data or the exact number of files involved has not been disclosed in the announcement.

About Terralogic

Terralogic is a global technology services company that provides digital transformation, software development, product engineering, and cloud solutions. The company offers end-to-end engineering services that help businesses modernize their technological infrastructure.

Potential impact and security implications

These claims may pose risks to the operational continuity of the organization and its clients. The alleged exposure of password data could lead to identity theft and targeted phishing attacks against employees and clients. Because the organization is based in the United States, this incident may result in legal consequences under state laws and relevant data protection regulations.

Additionally, the potential exposure of third-party client data could create concerns regarding supply chain security. In modern cyber threat landscapes, attacks on technology service providers often aim to leverage the trusted connection between the provider and its clients to reach wider networks. This type of incident highlights the importance of robust identity and access management, particularly regarding Active Directory security and the protection of password management systems.

For organizations operating in the technology and services sector, maintaining rigorous security protocols is essential to mitigate such risks. This includes implementing strong encryption for data at rest and in transit, enforcing multi-factor authentication to protect against the use of stolen password hashes, and ensuring that backup devices are isolated from the primary network to prevent encryption by ransomware. As information about the secp0 group remains limited, organizations are encouraged to maintain heightened vigilance against potential secondary attacks stemming from such breaches.