FOG Ransomware Breach Hits Fromm International
FOG Ransomware Group Targets Fromm International: A Detailed Analysis
Fromm International, a longstanding leader in the beauty industry, has recently fallen victim to a ransomware attack orchestrated by the FOG ransomware group. This incident underscores the growing threat of cybercrime in the consumer services sector, particularly for companies with a significant digital footprint.
About Fromm International
Founded in 1907, Fromm International has evolved from its origins as the Illinois Razor Strop Company into a major player in the beauty industry. The company is renowned for its high-end salon tools and accessories, serving both professional and consumer markets. With a facility spanning 70,000 square feet in Mt. Prospect, Illinois, and employing approximately 57 individuals, Fromm generates an estimated annual revenue of $31.7 million. Its commitment to quality and innovation has solidified its reputation, making it a standout in the beauty sector.
Details of the Ransomware Attack
The FOG ransomware group claims to have exfiltrated 16 GB of sensitive data from Fromm International. This breach potentially exposes critical information, including customer details and credit card data, posing a significant risk to customer privacy and financial security. The attack highlights vulnerabilities in Fromm's cybersecurity infrastructure, which may have been exploited through compromised VPN credentials or known application vulnerabilities.
FOG Ransomware Group Profile
First identified in November 2021, the FOG ransomware group is a variant of the STOP/DJVU family. It is known for its rapid encryption capabilities and sophisticated attack mechanisms, including privilege escalation and data exfiltration. The group has recently shifted its focus to more lucrative targets, such as the financial sector, but continues to pose a threat across various industries.
Potential Penetration Methods
FOG ransomware typically gains initial access through compromised VPN credentials or by exploiting known vulnerabilities in applications. Once inside, it employs techniques like pass-the-hash attacks to escalate privileges and encrypt critical files, including virtual machine disks. The group's ability to delete backups further complicates recovery efforts, making it a formidable adversary for companies like Fromm International.
Sources
Disclaimer
The Halcyon Attacks Lookout Database is compiled using publicly available information based on the hosting choices of real-world threat actors and data from a variety of trackers. This information is provided in accordance with principles of fair use. Halcyon has made reasonable efforts to sanitize and verify the data; however, we do not guarantee the accuracy, completeness, or reliability of the information provided. Updates to the database are made as new source data becomes available from reputable sources. By accessing, viewing, or using the information within the Halcyon Attacks Lookout Database, you acknowledge and agree to do so entirely at your own risk. No reliance should be placed upon the information for decision-making, and Halcyon disclaims all liability for any inaccuracies or omissions in the data.
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!