FOG Ransomware Breach Hits Fromm International

Incident Date:

October 18, 2024

World map

Overview

Title

FOG Ransomware Breach Hits Fromm International

Victim

Fromm International

Attacker

Fog

Location

Mt Prospect, USA

Illinois, USA

First Reported

October 18, 2024

FOG Ransomware Group Targets Fromm International: A Detailed Analysis

Fromm International, a longstanding leader in the beauty industry, has recently fallen victim to a ransomware attack orchestrated by the FOG ransomware group. This incident underscores the growing threat of cybercrime in the consumer services sector, particularly for companies with a significant digital footprint.

About Fromm International

Founded in 1907, Fromm International has evolved from its origins as the Illinois Razor Strop Company into a major player in the beauty industry. The company is renowned for its high-end salon tools and accessories, serving both professional and consumer markets. With a facility spanning 70,000 square feet in Mt. Prospect, Illinois, and employing approximately 57 individuals, Fromm generates an estimated annual revenue of $31.7 million. Its commitment to quality and innovation has solidified its reputation, making it a standout in the beauty sector.

Details of the Ransomware Attack

The FOG ransomware group claims to have exfiltrated 16 GB of sensitive data from Fromm International. This breach potentially exposes critical information, including customer details and credit card data, posing a significant risk to customer privacy and financial security. The attack highlights vulnerabilities in Fromm's cybersecurity infrastructure, which may have been exploited through compromised VPN credentials or known application vulnerabilities.

FOG Ransomware Group Profile

First identified in November 2021, the FOG ransomware group is a variant of the STOP/DJVU family. It is known for its rapid encryption capabilities and sophisticated attack mechanisms, including privilege escalation and data exfiltration. The group has recently shifted its focus to more lucrative targets, such as the financial sector, but continues to pose a threat across various industries.

Potential Penetration Methods

FOG ransomware typically gains initial access through compromised VPN credentials or by exploiting known vulnerabilities in applications. Once inside, it employs techniques like pass-the-hash attacks to escalate privileges and encrypt critical files, including virtual machine disks. The group's ability to delete backups further complicates recovery efforts, making it a formidable adversary for companies like Fromm International.

Sources

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.