Werewolves claims data breach at krasnoyarsk.amaks

• Ransomware group: Werewolves
• Country: Russia
• Sector: Hospitality
• Announcement date: December 20, 2023

The threat group known as Werewolves has announced that it has compromised a significant amount of data belonging to the hospitality business krasnoyarsk.amaks. According to the claim made by the group, the breach involves a substantial volume of information, potentially impacting the security and privacy of the organization's operations.

The alleged incident and claims by Werewolves

On December 20, 2023, the Werewolves group posted an announcement on their leak site regarding the compromise of krasnoyarsk.amaks. The threat actors allege that the organization suffers from vulnerabilities within its information security processes. Specifically, the group claims that the organization's customer data remains unprotected against unauthorized access.

The group has stated that the alleged stolen data will be made available for public access through mirrors on the TOR network. While the group has made these claims, it is important to note that the public information regarding the specific activities and identity of this group remains limited. In many modern cyberattacks, threat actors utilize leak sites to pressure organizations through a method often referred to as double extortion. In such scenarios, attackers not only encrypt an organization's systems but also steal sensitive data, threatening to release it publicly to increase the pressure to pay a ransom.

Data involved in the alleged breach

The Werewolves group claims that the volume of data compromised is approximately 1 terabyte. Although the group has made these assertions, the specific contents of the data have not been fully verified through the provided evidence. The group provided a screenshot to support their claims; however, this screenshot contains a generic template and does not display any specific file samples that would confirm the nature of the stolen information.

Despite the lack of specific file samples, the group claims that the compromised information includes the following:

• Customer data

No information was provided regarding the specific file count or the amount of a ransom demand.

Organization profile

The target of this alleged attack, krasnoyarsk.amaks, is identified as the AMAKS City Hotel. This establishment is a 15-story business hotel located in Krasnoyarsk, Russia. It operates as part of the larger AMAKS Hotels&Resorts chain and is described as a modern establishment that provides various hospitality and hotel services.

Potential impact and security considerations

This incident may have a negative impact on the organization's customer privacy and its overall data security processes. The potential exposure of customer data could increase the risk of individuals being subjected to identity theft or targeted phishing attacks. When sensitive personal information is leaked, it often becomes a tool for further social engineering attacks against the affected individuals.

For organizations operating within the hospitality sector, such incidents can result in long-term consequences for their commercial reputation. The organization may need to be evaluated within the framework of data breach notification obligations and potential legal sanctions. To defend against such threats, organizations typically focus on strengthening their information security posture through robust access controls, continuous monitoring, and regular vulnerability assessments. Maintaining strict data protection protocols is essential to mitigate the risks associated with identity theft and to preserve the trust of their clientele.