The Royal Commission for Riyadh City targeted by alphv ransomware group

• Ransomware group: alphv
• Country: Saudi Arabia
• Sector: Government & Defense
• Announcement date: July 26, 2023

The alphv ransomware group claims data breach at The Royal Commission for Riyadh City

The Royal Commission for Riyadh City (RCRC) has been listed in a data leak announcement by the alphv ransomware group. According to the claim made by the threat actors, the group has successfully exfiltrated 1.3 TB of data from the organization's networks.

Details of the alleged data exfiltration

The alphv group has listed data allegedly belonging to The Royal Commission for Riyadh City on its leak site. The threat actor claims to have exfiltrated 1.3 TB of data from the organization's networks. The announcement suggests that the leaked material includes documents related to the organization's operational and administrative processes, as well as personal information.

The announcement claims a total of 1.3 TB of data. Based on the provided screenshots, the following types of information are reportedly included in the leak:

• Passport copies
• Invoices
• Corporate information
• Email backups

About The Royal Commission for Riyadh City

The Royal Commission for Riyadh City is the official government entity responsible for the urban, economic, social, and infrastructural development of Riyadh, the capital of Saudi Arabia. It is authorized to manage the city's planning, digital infrastructure, and public services.

Analysis and potential impact of the claim

The alphv (BlackCat) group is a ransomware operation developed in Rust that emerged in late 2021. This claim may pose risks to the organization's sensitive government data and personal information. The alleged exfiltration of passports and email backups could facilitate identity theft or targeted phishing attacks against employees and third parties. Given the organization's public service-oriented nature, impacts on operational continuity may be observed.

Ransomware attacks often involve a tactic known as double extortion, where threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to release stolen information on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential records. This method increases the pressure on organizations, especially those in the government and public service sectors where data privacy and operational continuity are critical.

While the alphv group announced the cessation of its activities as of 2024, the potential for secondary risks from previously exfiltrated data remains. Even if a group is no longer actively operating, the data stolen in previous breaches can be sold on illicit forums or used in subsequent, unrelated campaigns. Organizations facing such threats often prioritize robust data encryption, strict access controls, and comprehensive employee training to mitigate the risks of phishing and unauthorized data access.