British IT services company Agilitas has been listed on the dark web site of the Donut ransomware group after a suspected ransomware attack. The gang claims to possess the source code and SQL databases belonging to the company.
The gang claims to have contacted Agilitas, which is based in Nottingham and was founded in 1990. Agilitas provides networking, server and storage solutions to its customers across the “United Kingdom” and works with suppliers including Cisco, Dell and Oracle.
No ransom demand or payment deadline has been published on the website.
Data extortion and ransomware gangs often threaten to leak information onto the dark web as a means of forcing a victim company to cooperate with their demands. This post may be evidence that the gang contacted the company and refused to cooperate, in line with the UK’s National Cyber Security Centre (NCSC) guidance on how to deal with such an attack.
The Donut ransomware group was first spotted in action by security researchers in August of this year and appears to favor data extortion tactics. So far this year, it has attacked Greek gas company DESFA, British architecture firm Sheppard Robson, and construction company Sando.
Its victims appear to be published by other prolific ransomware gangs, such as Hive and Ragnor Locker, although the data published on Donut's victim blog tends to be more extensive than the information appearing elsewhere.
A German insurance company called Gossler, Gobert and Wolters Group (GGW Group) has also posted on Donut's blog. The group claims to have removed 2.6TB of data from the company's computer network.
A spokesperson for Agilitas IT Solutions confirmed that the company has been the victim of a cyberattack by an organized crime group, but added that “the business remains fully operational.”.
Information source: techmonitor.ai
