Trigona ransomware group claims data breach against America Movil

• Ransomware group: Trigona
• Country: Mexico
• Sector: Professional Services
• Announcement date: February 14, 2024

Trigona ransomware group claims data breach against America Movil

The Trigona ransomware group has published a leak announcement on its platform, claiming that it has successfully targeted the multinational telecommunications corporation America Movil. According to the post made on February 14, 2024, the threat actor group alleges that they have compromised various internal documents and sensitive information belonging to the organization. The group claims the attack occurred on January 25, 2024.

Details of the alleged attack and ransom demand

The announcement made by the Trigona group alleges that the breach involves a variety of critical corporate information. Specifically, the group claims to have gained access to internal correspondence, various contracts, and sensitive financial documents. This type of claim is characteristic of modern ransomware operations, where the goal is not just to encrypt systems but to threaten the public release of stolen information.

In exchange for not releasing the files on their leak site, the Trigona group is demanding a ransom payment of 10,000,000.00. This high ransom demand suggests that the group is attempting to exploit the perceived sensitivity and value of the corporate data they claim to have exfiltrated. Such tactics are often associated with double-extortion methods, where attackers both encrypt data to disrupt operations and threaten to leak it to maximize pressure on the victim.

Data types allegedly compromised

Based on the screenshots provided by the attackers, the leaked information reportedly includes several types of highly sensitive corporate and personal documents. The group has shared evidence suggesting that the following data types are involved in the breach:

• Employee email addresses
• Financial reports
• Contracts
• Tax declarations
• System access forms

The presence of such diverse documentation, ranging from financial records to system access requests, indicates a broad scope of the alleged intrusion into the corporate environment.

About America Movil

América Móvil is a multinational telecommunications corporation headquartered in Mexico, operating globally. The company provides a wide range of communication solutions, including mobile and fixed-line services, broadband internet, and pay television.

Potential impact and security implications

The alleged leak poses significant risks to the organization's operational security and customer privacy. The exposure of personal data contained within these documents could potentially lead to identity theft or facilitate targeted phishing attacks directed at employees and business partners. Furthermore, the breach may trigger legal proceedings in accordance with data protection regulations in the various regions where the organization operates.

While information regarding the specific identity and methods of the Trigona group remains limited, their actions demonstrate the use of double-extortion tactics. In such scenarios, organizations face the dual threat of operational downtime and reputational damage caused by data exposure. To defend against such threats, organizations in the telecommunications and professional services sectors typically focus on robust data protection, monitoring for unauthorized access, and implementing strict controls over sensitive documentation and system access requests.