Vivara listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Brazil
• Sector: Professional Services
• Announcement date: July 25, 2024

Medusa ransomware group claims attack on Vivara

The Medusa ransomware group has published a leak announcement on its dedicated site, claiming to have compromised the systems of Vivara, a major jewelry retailer based in Brazil. According to the threat actor, the breach occurred on July 24, 2024, with the official announcement appearing on the leak site on July 25, 2024. The group alleges that they have successfully exfiltrated a significant volume of data from the organization's infrastructure.

The Medusa group claims to have obtained approximately 1.18 TB of data from the company. This massive volume of information suggests a deep intrusion into the corporate network. The threat actor's post indicates that the stolen information is not limited to general corporate files but extends to highly sensitive and confidential materials. The group has provided a screenshot that shows a verification screen, which is a standard requirement for users attempting to access the group's leak site.

Details of the alleged data breach

The content of the leaked data, as claimed by the Medusa group, is extensive and highly sensitive. The threat actor alleges that the stolen files include confidential information belonging to several key groups within the organization. Specifically, the leaked data is said to include information regarding:

• CEO data
• Top management data
• Employee data
• Customer data

Beyond the personal and professional information of individuals, the threat actor further alleges that the stolen files include documents related to the company's hidden illegal activities. Such claims, if true, represent a significant escalation in the pressure applied by the attackers during a ransomware incident.

About Vivara

Vivara is the largest jewelry retailer based in Brazil. The company operates a business model that involves selling its own unique jewelry designs alongside a wide range of watches from various luxury brands. As a major player in the professional services and retail sector, the company maintains a significant presence in the Brazilian market.

Analysis and potential implications

The Medusa group is recognized as a Ransomware-as-a-Service (RaaS) entity that has been active since 2021. This group is known for employing double extortion tactics. In a double extortion scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak confidential data on a public site, the attackers aim to maximize the pressure on the victim to pay the ransom, often using the threat of reputational damage or legal consequences as a primary motivator.

The potential leakage of the data claimed by Medusa could result in severe secondary risks for the affected parties. For employees and customers, the exposure of personal information increases the risk of identity theft and makes them targets for highly personalized and sophisticated phishing attacks. Furthermore, the allegations regarding illegal activities could lead to significant reputational damage and potentially trigger various legal proceedings against the organization.

From a regulatory perspective, under Brazil's General Data Protection Law (LGPD), the organization may face strict data breach notification requirements and the possibility of facing legal sanctions. The publication of such data can also disrupt the organization's operational and financial processes due to the nature of the double extortion method. In general, organizations facing such threats are encouraged to maintain robust data protection frameworks, implement strict access controls, and ensure comprehensive monitoring of their networks to detect unauthorized exfiltration early.