Una Seguros listed on Play ransomware leak site

• Ransomware group: Play
• Country: Angola
• Sector: Financial Services
• Announcement date: December 11, 2022

Una Seguros listed on Play ransomware leak site

The Play ransomware group has listed the Angolan insurance company Una Seguros on its leak site. This announcement, made on December 11, 2022, involves a claim that the group has compromised data belonging to the organization.

Details of the alleged attack

According to the claim made by the Play ransomware group, they have successfully targeted Una Seguros. The group officially listed the organization on its dedicated leak site on December 11, 2022, the same date they claim the attack took place. This public listing suggests that the group may have gained unauthorized access to the organization's network and subsequently exfiltrated data from their systems.

Ransomware groups often use leak sites to pressure victims into paying ransoms. These sites serve as a public gallery where threat actors post the names of organizations they have successfully breached. By listing a company, the group aims to damage the victim's reputation and create urgency. In this specific instance, the announcement serves as a claim of a successful intrusion and data theft.

Information regarding the compromised data

At this time, the leak site has not provided any screenshots or detailed information regarding the specific nature of the compromised data. The listing does not specify what types of files or information were allegedly taken during the incident. Consequently, the listing names no specific data types.

The risks of double extortion

The Play group is known to operate using double-extortion tactics. In a double-extortion scheme, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of leaking this stolen data on a public site provides the attackers with additional leverage during ransom negotiations. If the victim refuses to pay, the group threatens to release the sensitive information, which can lead to significant regulatory, legal, and reputational consequences for the organization.

About Una Seguros

Una Seguros is an insurance company based in Angola. The organization provides various insurance and risk management solutions to both individual and corporate clients.

Implications and organizational risks

This situation indicates that the sensitive data of the organization could have been accessed by unauthorized parties. Because the Play group utilizes double-extortion methods, there is a potential risk that the alleged stolen data could eventually be published on the internet. Such a leak could result in the data being utilized for identity theft or targeted phishing attacks against the organization or its clients.

Depending on the data protection regulations in the jurisdiction where the organization operates, legal notification obligations might arise in the event of a potential data breach. Organizations in the financial services sector must remain vigilant, as they often handle high volumes of sensitive personal and corporate information. General defensive measures for organizations facing such threats typically include maintaining robust network monitoring, implementing strict access controls, and ensuring regular backups are stored offline to mitigate the impact of encryption-based attacks.

Public information regarding the Play group remains limited, making it difficult to determine the full scope of their operations or their specific technical methodologies. However, the listing of a financial services provider highlights the ongoing risks faced by the insurance industry from sophisticated ransomware actors.