Werewolves ransomware group claims data breach at habarovsk.amaks

• Ransomware group: Werewolves
• Country: Russia
• Sector: Hospitality
• Announcement date: December 20, 2023

Werewolves ransomware group claims data breach at habarovsk.maks

The threat actor group known as Werewolves has announced an alleged data leak concerning habarovsk.maks. This announcement, posted on a leak site, suggests that the organization has been targeted in a cyberattack, though the specific details regarding the extent of the breach remain limited to the claims made by the attackers.

Details of the alleged attack

According to the announcement published by the Werewolves group, the network infrastructure and servers belonging to habarovsk.maks are currently unprotected. The threat actor asserts that they have successfully gained access to sensitive information within the organization's environment. Specifically, the group claims to have compromised customer data and video surveillance servers.

The group has stated that all the stolen information will be published on the group's mirrors and partner websites. While the group has made these claims, the provided screenshot associated with the announcement does not contain any specific document samples regarding the leak, leaving the actual content of the stolen data unverified at this time. The attack is claimed to have occurred on September 24, 2023, with the leak announcement appearing on December 20, 2023.

Data allegedly compromised in the breach

The claims made by the Werewolves group suggest that several categories of sensitive information have been targeted. Based on the group's announcement, the following types of data are said to be involved in the breach:

• Customer data
• Network infrastructure information
• Video surveillance server data

It is important to note that while the group claims to have accessed these specific areas, no specific file counts or the total size of the data have been provided in the announcement.

About habarovsk.maks

AMAKS Congress Hotel is an eight-story hotel located in Khabarovsk, Russia. The facility features nearly 200 rooms and has a capacity to accommodate up to 300 guests. It is situated in close proximity to the Platinum Arena sports complex.

Risk assessment and industry implications

This incident may pose significant risks to the institution's customer privacy and operational security. The claim regarding the compromise of video surveillance data could lead to secondary risks concerning guest privacy, as such data often contains sensitive visual records of individuals within the premises.

Furthermore, the assertion that the institution's network infrastructure is unprotected may result in the entity becoming a target for future attacks. In the event of a confirmed data breach, the institution may be required to fulfill notification obligations under relevant legal frameworks. Public information regarding the Werewolves group remains limited, making it difficult to ascertain their specific tactics or long-term objectives.

In the broader context of cybersecurity, such incidents often involve double extortion tactics. In these scenarios, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten the victim with public disclosure. This pressure is used to coerce the organization into paying a ransom. For organizations in the hospitality sector, protecting guest privacy and maintaining the integrity of surveillance systems is critical to maintaining trust and operational continuity. Defensive measures typically include implementing robust network segmentation, enforcing multi-factor authentication, and maintaining regular, offline backups to mitigate the impact of such breaches.