Visit Faroe Islands targeted by SiegedSec ransomware group

• Ransomware group: SiegedSec
• Country: Faroe Islands
• Sector: Hospitality
• Announcement date: December 8, 2023

SiegedSec claims data breach at Visit Faroe Islands

The threat actor known as SiegedSec has published a leak announcement regarding the visitfaroeislands.com domain. According to the claim, the group gained access to the institution's website and obtained a significant amount of information. This announcement was made on a leak site on December 8, 2023, following an alleged attack date of November 26, 2023.

The group's claims suggest a multi-stage compromise. In addition to the unauthorized access to the website, it is alleged that the website was defaced for a period of time. Defacement is a common tactic used by cybercriminals to signal a successful breach and to exert pressure on the victim organization. Furthermore, the group alleges that they have successfully acquired the organization's source codes during the intrusion.

Details of the claimed data theft

The announcement made by SiegedSec specifies the volume and nature of the data they claim to have exfiltrated. The group asserts that they have obtained approximately 30 GB of data from the target. The specific contents of the leak, as described in the announcement, include the following items:

• User data
• Source code

While the group has provided the total size of the data, no information was given regarding the specific file count or the amount of the ransom demand. The nature of the announcement is categorized as a data leak.

About Visit Faroe Islands

Visit Faroe Islands is the official tourism board for the Faroe Islands. It serves as a central resource for the region, providing travel guides, accommodation options, and various information regarding tourist activities for visitors to the region.

Security implications and organizational risks

The alleged leak poses significant risks to the institution's user privacy and overall data security. The potential exposure of user data could lead to various secondary attacks, such as identity theft or phishing attempts, where attackers use stolen information to deceive individuals. Additionally, the publication of source code is a serious security concern, as it might leave the system more vulnerable to future security exploits by providing attackers with a roadmap of the application's architecture and potential weaknesses.

In the context of modern cyber threats, this incident highlights the risks associated with double extortion. In such scenarios, ransomware groups do not just encrypt data to disrupt operations; they also steal sensitive information to use as leverage, threatening to leak it publicly if a ransom is not paid. This tactic increases the pressure on organizations, as the threat shifts from operational downtime to permanent reputational and legal damage.

The incident may have legal implications under data protection regulations such as GDPR, depending on the nature of the user data involved and the residency of the affected individuals. For organizations operating in the hospitality and tourism sectors, maintaining robust security postures is essential. Common defensive steps include implementing strong access controls, conducting regular security audits, and ensuring that all software and source code are protected against unauthorized access. Organizations should also prioritize data encryption and have a clear incident response plan to mitigate the impact of potential breaches.

Public information regarding the SiegedSec group remains limited, making it difficult to attribute the attack to a specific known entity or to predict their future patterns. As cyber threats evolve, the reliance on official tourism boards and public-facing websites makes them attractive targets for groups looking to maximize visibility through high-profile leaks.