Unita Turism listed on meow ransomware leak site

• Ransomware group: meow
• Country: Romania
• Sector: Hospitality
• Announcement date: October 11, 2024

Unita Turism targeted by meow ransomware group

The Romanian hospitality company Unita Turism has been listed on the leak site associated with the meow ransomware group. According to an announcement made on October 11, 2024, the threat actor claims to have successfully conducted a data breach against the organization, alleging that a significant volume of sensitive information has been exfiltrated.

The threat actor known as meow claims to have obtained 117 GB of data belonging to Unita Turism. The group has outlined a specific ransom demand for the stolen information, stating that the data will be sold for $40,000 to a single buyer. Alternatively, the group has offered the data to multiple buyers for a price of $20,000. To support the validity of their claims and demonstrate that the organization's operational and personal data has been compromised, the group has shared various document samples in their public post.

Claimed data types and contents

The post made by the threat actor claims that the stolen information includes a wide range of sensitive documents and personal identifiers. The alleged breach involves various types of data that could impact both the company's internal operations and the privacy of individuals. The specific categories of data mentioned in the claim include:

• Employee information
• Client information
• Banking details
• Financial reports
• Invoices
• Tax declarations
• Passport scans
• Dates of birth
• Addresses
• Insurance policies
• Medical records

The presence of such diverse data types, ranging from financial documents to highly sensitive medical records and passport scans, suggests a broad compromise of the organization's digital environment.

About Unita Turism

Unita Turism is a tourism company that operates various hotels, resorts, and accommodation facilities across Romania. The company aims to promote Romania's natural and cultural heritage by serving both domestic and international tourists.

Analysis and potential implications

The allegedly compromised data may increase the risk of identity theft and fraud for both employees and customers. The sensitivity of the information, particularly the inclusion of medical records and passport information, may have long-term implications for the privacy of the individuals involved. Because the organization operates in Romania, it is possible that the company could face administrative sanctions if it is found to have failed to meet its data protection obligations under the EU General Data Protection Regulation (GDPR).

While public information regarding the meow group remains limited, the nature of the ransom demand and the method of the data leak suggest the use of a double-extortion strategy. In a double-extortion scenario, threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten the victim with public disclosure unless a ransom is paid. This tactic increases the pressure on organizations to comply with demands to avoid reputational damage or regulatory scrutiny.

For organizations operating in the hospitality sector, such incidents highlight the critical importance of robust data protection measures. To mitigate the risks associated with such breaches, organizations typically need to implement comprehensive security frameworks, conduct regular audits, and ensure strict compliance with regional data protection laws. Furthermore, in the event of a confirmed breach, the affected organization may need to notify the individuals whose data has been compromised and implement necessary security measures to prevent future occurrences.