Global talent management behemoth Allegis Group claimed by hacker gang
Allegis Group, a multi-billion-dollar talent management group, has allegedly been breached by a ransomware cartel. The attackers claim to have accessed client lists and other, so far undisclosed, company documents.
The US-headquartered talent management company was posted on the Everest ransomware gang’s dark web blog, which it uses to showcase its latest victims. The attackers claim to have access to “internal company documents” with information about Allegis Group’s clients.
Allegis Group is one of the world’s largest talent management firms with an estimated yearly revenue of nearly $10 billion. The company’s subsidiaries include Aerotek, TEKsystems, MarketSource, and other specialized talent management companies.
We have reached out to Allegis Group for comment and will update the article once we receive a reply.
Meanwhile, the Cybernews research team looked into the dark web post. The attackers shared only a limited preview of what they have allegedly stolen from Allegis, with only two screenshots from what looks like an Excel document.
According to the team, the screenshots supposedly show information about the company’s clients. One set, containing client names, email addresses, and phone numbers, is supposed to contain 135,000 lines, while another, which includes similar types of data, boasts 426,000 lines.
Our researchers believe that this type of information could be exploited for phishing attacks. For example, malicious actors could impersonate Allegis Group in an attempt to coax victims into revealing more data or even download malware.
“The post also mentions “huge variety of personal documents,” but the attackers don't provide any samples. These documents could potentially be more dangerous than just contact info included in the visible screenshots,”
the team explained.
“The post also mentions “huge variety of personal documents,” but the attackers don't provide any samples. These documents could potentially be more dangerous than just contact info included in the visible screenshots,” the team explained.
Leaking information in small chunks is a common tactic employed by ransomware cartels. It’s supposed to put pressure on victims, so they would be more inclined to meet the attackers’ ransom demands.
The Everest ransomware gang are dinosaurs
The Everest gang, believed to be Russia-linked, was first spotted in 2021, ancient times in the extremely volatile ransomware industry.
The gang first made headlines after the October 2022 attack on the American telecommunications behemoth AT&T. At the time, Everest said it had access to AT&T’s entire corporate network.
More recently, Everest claimed responsibility for an attack on Coca-Cola’s Middle East division, eventually leaking the data of nearly 1000 employees. It also claimed a data breach of Crumbl, the North American gourmet cookie shop chain.
According to Cybernews’ dark web monitoring tool, Ransomlooker, Everest has victimized at least a hundred organizations over the past 12 months, putting it among the most notorious cybercrime cartels.
