Tpa-group.sk data allegedly listed on Underground ransomware leak site

• Ransomware group: Underground
• Country: Slovakia
• Sector: Professional Services
• Announcement date: May 1, 2024

Underground claims to have stolen data from Tpa-group.sk

The threat actor known as Underground has listed a significant amount of data allegedly belonging to Tpa-group.sk on its dedicated leak site. According to the announcement made on May 1, 2024, the group claims to have compromised the organization's systems, resulting in the theft of a massive dataset. This alleged breach involves a total volume of 186.3 GB of data, which the group asserts was obtained during an attack that reportedly took place on July 4, 2023.

The Underground group has published this information as part of its typical operations on leak sites. These platforms are frequently used by ransomware groups to pressure victims into paying ransoms by threatening to release sensitive information to the public. While the group has made these claims, public information regarding the specific identity and technical capabilities of the Underground group remains limited in the public domain.

The scope of the alleged data leak

The announcement specifies that the stolen dataset contains a wide variety of sensitive information, including both financial records and client-related documentation. The breadth of the data suggests a deep penetration into the organization's internal files and communications. The leaked information is said to include the following items:

• Client email communications
• Confidentiality agreements
• Accounting and tax reports
• Audit documents
• Financial documents
• Passports and ID copies
• Bank documents
• Payroll data
• Employee personal information

The presence of such diverse data types—ranging from corporate financial reports to highly sensitive personal identifiers like passports and national identification numbers—indicates a high level of sensitivity in the alleged leak. The theft of payroll and bank documents further highlights the potential impact on both the organization and the individuals whose data is contained within the files.

About Tpa-group.sk

Tpa Group is an international professional services firm that maintains a significant operational presence across Central and Southeastern Europe. The firm specializes in providing a variety of essential business services, including tax advisory, auditing, and accounting. Its Slovakian office plays a key role in the organization's regional operations, offering specialized financial and strategic consulting solutions to a diverse range of both local and international clients.

Risk assessment and organizational implications

This alleged leak poses several significant risks to the organization and its stakeholders. For the clients and employees of Tpa Group, the exposure of personal identifiers, such as ID copies and national identification numbers, creates secondary risks, including the potential for identity theft and highly targeted phishing attacks. Such attacks often leverage the specific details found in leaked documents to gain trust and deceive victims.

Furthermore, because the entity is based in Slovakia, this incident could lead to serious legal consequences under the EU General Data Protection Regulation (GDPR), which mandates strict protections for personal data. The sensitivity of the disclosed information may also cause lasting damage to the organization's professional reputation and could negatively impact the security of its broader supply chain. It is anticipated that the group may be employing a double-extortion strategy, a common ransomware tactic where attackers not only encrypt data but also steal it to use as leverage for extortion. The publication of data samples is often intended to exert maximum pressure on the target organization to meet ransom demands.

In such scenarios, organizations in the professional services sector often focus on strengthening their defensive posture through multi-layered security strategies. This typically includes implementing robust encryption for data at rest and in transit, enforcing strict access controls, and maintaining comprehensive logging and monitoring to detect unauthorized access. Additionally, regular security awareness training for employees and rigorous third-party risk management are essential components of a modern cybersecurity defense framework.