WDNA listed on fog ransomware leak site

• Ransomware group: fog
• Country: Spain
• Sector: Technology
• Announcement date: February 23, 2025

Spanish technology company WDNA listed on fog ransomware leak site

The Spanish technology company WDNA has been listed on the leak site of the ransomware group known as fog. According to an announcement published on February 23, 2025, the threat actor claims to have successfully compromised data belonging to the organization.

Details of the alleged attack

The threat actor known as fog claims to have compromised data belonging to WDNA in an announcement published on February 23, 2025. The group has listed a 10 GB dataset on their leak site. While the group has made this public claim, information regarding this specific threat actor remains limited in the public domain. The announcement states that the data allegedly belonging to WDNA has been leaked via a 10 GB torrent file.

Affected data types

• Gitlab data

About WDNA

WDNA (Wireless Domestic Network Auditors) is a Spanish technology group specializing in network monitoring and auditing, advanced meteorology, and IoT monitoring of critical infrastructures. The company develops innovative solutions through its entro© platform.

Risk assessment and implications

The implications of this alleged leak depend heavily on the nature of the stolen information. If the alleged leaked data contains Gitlab source code or sensitive configuration files, the institution's intellectual property and operational security may be at risk. Such a breach of technical assets can provide attackers with insights into the internal workings of an organization's software development lifecycle.

Furthermore, because the institution is based in Spain, the leak may result in legal consequences under the EU General Data Protection Regulation (GDPR). If the shared data includes employee or customer information, it could create a foundation for identity theft or targeted phishing attacks. These types of secondary attacks often follow data breaches as threat actors attempt to leverage stolen credentials or personal details to gain further access to corporate networks or to defraud individuals.

Additionally, as the institution develops solutions for monitoring critical infrastructure, the leak may pose secondary risks regarding supply chain security. When companies providing services to critical infrastructure are compromised, the potential impact can extend beyond the organization itself to the entities that rely on their technology. This highlights the importance of robust security measures for organizations operating within the technology and critical infrastructure sectors.

In general, ransomware groups often employ double extortion tactics, where they not only encrypt an organization's data but also steal sensitive information to use as leverage during negotiations. To defend against such threats, organizations typically implement multi-factor authentication, maintain regular offline backups, and conduct continuous monitoring of their networks to detect unauthorized access or data exfiltration attempts. Strengthening supply chain security through rigorous third-party risk management is also a vital component of a modern defensive posture.