FOG Ransomware Breach Hits Fromm International
Incident Date:
October 18, 2024
Overview
Title
FOG Ransomware Breach Hits Fromm International
Victim
Fromm International
Attacker
Fog
Location
First Reported
October 18, 2024
FOG Ransomware Group Targets Fromm International: A Detailed Analysis
Fromm International, a longstanding leader in the beauty industry, has recently fallen victim to a ransomware attack orchestrated by the FOG ransomware group. This incident underscores the growing threat of cybercrime in the consumer services sector, particularly for companies with a significant digital footprint.
About Fromm International
Founded in 1907, Fromm International has evolved from its origins as the Illinois Razor Strop Company into a major player in the beauty industry. The company is renowned for its high-end salon tools and accessories, serving both professional and consumer markets. With a facility spanning 70,000 square feet in Mt. Prospect, Illinois, and employing approximately 57 individuals, Fromm generates an estimated annual revenue of $31.7 million. Its commitment to quality and innovation has solidified its reputation, making it a standout in the beauty sector.
Details of the Ransomware Attack
The FOG ransomware group claims to have exfiltrated 16 GB of sensitive data from Fromm International. This breach potentially exposes critical information, including customer details and credit card data, posing a significant risk to customer privacy and financial security. The attack highlights vulnerabilities in Fromm's cybersecurity infrastructure, which may have been exploited through compromised VPN credentials or known application vulnerabilities.
FOG Ransomware Group Profile
First identified in November 2021, the FOG ransomware group is a variant of the STOP/DJVU family. It is known for its rapid encryption capabilities and sophisticated attack mechanisms, including privilege escalation and data exfiltration. The group has recently shifted its focus to more lucrative targets, such as the financial sector, but continues to pose a threat across various industries.
Potential Penetration Methods
FOG ransomware typically gains initial access through compromised VPN credentials or by exploiting known vulnerabilities in applications. Once inside, it employs techniques like pass-the-hash attacks to escalate privileges and encrypt critical files, including virtual machine disks. The group's ability to delete backups further complicates recovery efforts, making it a formidable adversary for companies like Fromm International.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.