Globalcaja

Globalcaja was the victim of a Play ransomware attack that impacted operations at several offices of the bank.

The Play ransomware gang added the bank to the list of victims on its Tor leak site and claims to have stolen private and personal confidential data, clients and employee documents, passports, contracts, and more.

The bank confirmed that incident in a press release, the financial institution attempted to downplay the attack by saying that it has not affected the transaction of the entity or its clients.

The bank is investigating the incident and notified local authorities, it has yet to disclose a data breach.

Source: https://securityaffairs.com/147073/cyber-crime/globalcaja-confirms-play-ransomware-attack.html

TPRM report: https://scoringcyber.rankiteo.com/company/somosglobalcaja

"id": "glo0512623",
"linkid": "somosglobalcaja",
"type": "Ransomware",
"date": "06/2023",
"severity": "75",
"impact": "2",
"explanation": "Attack limited on finance or reputation"

{'affected_entities': [{'industry': 'Finance',
                        'name': 'Globalcaja',
                        'type': 'Bank'}],
 'attack_vector': 'Ransomware',
 'data_breach': {'type_of_data_compromised': ['private and personal '
                                              'confidential data',
                                              'clients and employee documents',
                                              'passports',
                                              'contracts']},
 'description': 'Globalcaja was the victim of a Play ransomware attack that '
                'impacted operations at several offices of the bank. The Play '
                'ransomware gang added the bank to the list of victims on its '
                'Tor leak site and claims to have stolen private and personal '
                'confidential data, clients and employee documents, passports, '
                'contracts, and more. The bank confirmed the incident in a '
                'press release and attempted to downplay the attack by saying '
                'that it has not affected the transactions of the entity or '
                'its clients. The bank is investigating the incident and '
                'notified local authorities, but it has yet to disclose a data '
                'breach.',
 'impact': {'data_compromised': ['private and personal confidential data',
                                 'clients and employee documents',
                                 'passports',
                                 'contracts'],
            'operational_impact': ['Impacted operations at several offices']},
 'investigation_status': 'Ongoing',
 'motivation': 'Financial Gain',
 'ransomware': {'ransomware_strain': 'Play'},
 'response': {'communication_strategy': ['Downplayed the attack'],
              'law_enforcement_notified': 'Yes'},
 'threat_actor': 'Play Ransomware Gang',
 'title': 'Globalcaja Play Ransomware Attack',
 'type': 'Ransomware'}