A new threat intelligence report on doxxing, researched by cybersecurity experts at Kivu, reveals that the majority of attacks occur in the U.S., with companies in the consumer sector being more likely to fall victim to such an attack.

Doxxing is the deliberate and malicious leaking of stolen data that happens once a ransomware attack has been deployed, says Kivu. Kivu, a cybersecurity solutions provider, has documented the active doxxing efforts of eight ransomware groups: Maze, REvil, DoppelPaymer, CL0P, Nephilim, Sekhmet, Mespinoza (PYSA) and RagnarLocker. A full breakdown of ransomware variant targets can be found in the report.

In What Doxxing Victims Reveal About “Targeted Attacks”, Kivu has analyzed the geographic and industry-based metrics of over 140 ransomware victims who were doxxed between February 1, 2020 and May 1, 2020. During this period, Kivu found that 55 percent of victims were based in the US, which is a stark departure from several 2019 reports that stated ransomware affects other regions of the world more frequently.

The recent findings suggest this disproportionate representation of US victims is likely the result of (a) more US victims being targeted, (b) more US victims refusing to pay, and (c) the geographic preferences of ransomware’s malware partners becoming more focused on the US in recent years.

Kivu’s analysis of industry-based trends revealed that the most commonly attacked business (30 percent of all attacks) fell within the consumer sector, which is comprised of non-essential goods and services such as retail, accounting services, and entertainment.

Sectors that theoretically would be considered attractive targets, such as consumer staples (5 percent), public sector (1 percent) and technology (7 percent), were notably underrepresented in the dataset.

Kivu concluded the profiles of doxxed victims demonstrated that companies are not being targeted based on how high profile they are or the kind of data they store, but instead are first and most targeted because of a vulnerability in their network.

Commenting on the findings, Lizzie Cookson, associate director at Kivu Consulting, said: “The recent foray into doxxing by threat actors in the ransomware world has given the cyber security industry a unique insight into more granular levels of detail regarding these extortions. Typically, we have only been able to glean information on ransomware attacks by what has been reported by the victims, but the lack of self-reporting following these attacks has historically made it difficult to get a clear picture of what the drivers of these attacks are,” she added.

Key findings:

• 55 percent of all doxxed victims were located or headquartered in the US, followed by 7 percent in the UK and 4 percent in France. The remaining 34 percent of victims were spread out across the globe.
• Companies that fall under the consumer sector were the most represented in the data at 30 percent. This was followed by 22 percent in industrials and 15 percent in financial services.
• Kivu’s investigation showed that ransomware variants generally do not favor one industry over another – rather, they are likely to deploy more successfully within certain environments, which are industry agnostic.

The full report can be accessed here.