Two Saints targeted by Noescape ransomware group

• Ransomware group: Noescape
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: October 31, 2023

The Noescape ransomware group has published a post on their leak site claiming to have compromised data belonging to Two Saints. The announcement, which was made on October 31, 2023, suggests a significant breach affecting the United Kingdom-based professional services organization.

The alleged attack and claims by Noescape

According to the claims made by the threat actor known as Noescape, the group successfully breached the network of Two Saints on October 25, 2023. The group asserts that they have encrypted the organization's data as part of their operation. The threat actor has stated that if the management of Two Saints does not initiate contact with them, they will proceed to publish the exfiltrated data.

The group claims to possess 9 GB of data. At this time, information regarding this specific group remains limited in the public domain. Ransomware attacks of this nature often follow a double extortion model, where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak the data on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information.

Data types allegedly compromised

The post from the Noescape group claims that the stolen information is highly sensitive and includes a wide variety of documents and personal details. The group alleges that the following types of data were exfiltrated during the breach:

• Passport data
• Agreements
• Employee personal data
• Client personal data
• Financial records
• Tax and audit documents

Beyond these categories, the group also claims the stolen data includes access credentials, insurance and purchase orders, budget and invoice information, and various other scanned documents.

About Two Saints

Two Saints is a non-profit organization operating in the United Kingdom. The organization provides essential housing and social support services to individuals who are homeless, vulnerable, or in need of support. Their operations are focused on regions such as Berkshire, Hampshire, and the Isle of Wight. The organization provides outreach and rehabilitation services specifically designed for people sleeping rough.

Potential impact and organizational risks

The alleged data breach poses significant risks to both the employees of Two Saints and the individuals who receive services from the organization. The sensitive nature of the data involved, such as passports and personal identifiers, creates a high risk of identity theft and fraud for the affected parties. Furthermore, the exfiltrated information could potentially be utilized by threat actors for secondary attacks or targeted phishing campaigns against the organization or its stakeholders.

As an entity operating within the United Kingdom, Two Saints may face legal obligations and potential administrative penalties under the UK GDPR regarding the protection of personal data. The sensitivity of the data is particularly concerning given the social support services provided by the organization; this incident may create additional risks for the vulnerable individuals served by the non-profit.

In general, organizations in the professional services and non-profit sectors can take several defensive steps to mitigate such risks. Implementing robust multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training are common industry practices. Additionally, maintaining strict access controls and monitoring network traffic for unusual activity can help in detecting and responding to unauthorized access before large amounts of data can be exfiltrated.