Verdecora data allegedly listed on Noescape ransomware leak site

• Ransomware group: Noescape
• Country: Spain
• Sector: Retail & E-Commerce
• Announcement date: November 30, 2023

Noescape claims to have compromised Verdecora

The Noescape ransomware group has listed data allegedly belonging to Verdecora on their leak site. According to the announcement made on November 30, 2023, the threat actor claims to have successfully compromised the organization's systems. The group alleges that the organization's servers were encrypted during the attack and that approximately 30 GB of data was exfiltrated from their network.

The timeline provided by the attackers suggests the claimed attack occurred on November 18, 2023. While the group has posted this information on their public leak site, public information regarding the specific tactics, techniques, and procedures of the Noescape group remains limited. This group is known to use leak sites as a primary method of operation, often employing double extortion tactics to increase pressure on their targets.

In modern ransomware campaigns, double extortion is a common strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information before the encryption occurs. By threatening to release this stolen data on a public leak site, the attackers aim to coerce the victim into paying a ransom to prevent the exposure of sensitive corporate or personal information.

Details of the allegedly stolen data

The announcement made by the Noescape group describes a significant volume of sensitive information that has supposedly been taken from Verdecora's systems. The group claims that the stolen data includes a wide variety of corporate and personal records. Specifically, the listing mentions that the following types of data are involved:

• Employee personal data
• Partner company data
• Contracts
• Financial records
• Accounting data

Beyond these categories, the group also claims to have obtained hundreds of contracts and agreements, various letters, document scans, and databases. The breadth of this alleged data set suggests a deep penetration into the organization's internal file systems and databases.

About Verdecora

Verdecora is a Spanish retail chain focused on the world of plants and pet products. The company operates within the retail and e-commerce sectors, offering a diverse range of products. Their offerings include items in the fields of gardening, home decoration, and pet care. Verdecora maintains a significant market presence through both its physical retail stores and its dedicated e-commerce platform.

Potential risks and organizational implications

The disclosure of the allegedly leaked data may pose several secondary risks. For employees and business partners whose information was targeted, the exposure of personal data can lead to identity theft or the execution of highly targeted phishing attacks. Such attacks often leverage the stolen information to appear legitimate, making them more difficult for individuals to detect.

Furthermore, the disclosure of corporate financial data can result in a loss of commercial reputation and create a significant competitive disadvantage for the organization. Because Verdecora operates within Spain, this incident may be subject to investigation by data protection authorities under the General Data Protection Regulation (GDPR) framework, which mandates strict protections for personal data.

In the retail and e-commerce sector, maintaining the integrity of customer and partner data is critical for business continuity. Organizations in this sector often implement defensive measures such as multi-factor authentication, regular security awareness training, and robust backup strategies to mitigate the risk of ransomware. Ransomware groups frequently use these public listings as a pressure tactic to force organizations into making payments, making the containment of the initial breach and the protection of sensitive data a top priority for modern enterprises.