What This Alert Means.
A ransomware leak site is a website where a criminal group names companies it claims to have attacked, often with a threat to publish stolen data. This alert means one of your suppliers appears on such a site. The supplier may hold your data, run part of your service or have a login into your network.
The risk is not only a leak of your data. Attackers who control a supplier can use its trusted access to reach you, and they can use stolen emails and contacts to write convincing phishing. The listing may be unconfirmed, so you act on what the supplier can do to you, not on the group's claims.
First 24 Hours.
Your first job is to learn what this supplier can reach. Your second is to reduce that reach until the facts are clear.
- SOC analyst Open the alert from the Brandefense third-party risk module and save the listing, date, group name and any sample filesKeep a copy in case it is removed
- Vendor manager Pull the contract and list what data, systems and accounts the supplier hasInclude personal data, source code, keys and invoices
- IT admin List every connection to the supplier, such as VPN tunnels, API keys, service accounts, shared mailboxes and single sign-on trustMark which can be paused without stopping the business
- Security engineer Limit or cut the riskiest connections and block unused onesPrefer a controlled pause to a full shutdown if the service is critical
- IT admin Rotate shared secrets such as API keys, passwords, tokens and certificatesStart with anything the supplier can read or store
- Vendor manager Contact the supplier's security contact in writing and ask for factsSee the question list in the checklist
- Communications Warn staff who deal with this supplier to expect phishingTell them to check any payment or login request by another channel
- Legal Ask whether you must notify anyone, and review your contract rightsCheck with your legal counsel
Investigation Checklist.
Use this list to scope the exposure and to frame your questions to the supplier.
- What data of yours does the supplier hold, and how sensitive is it?Classify it: personal, financial, secret or low value
- What access does the supplier have into your systems?Include accounts, tunnels, remote tools and API keys
- Has the supplier confirmed an incident?Ask in writing, and keep the reply
- Which of your data or systems does the supplier think was affected?Ask for the date range and the evidence
- Has the supplier closed the entry point and reset credentials?Ask what was reset and when
- Has the supplier told law enforcement and its national CERT?Ask for the reference if one exists
- Do your logs show odd sign-ins from the supplier's accounts or addresses?Review the period before and after the listing
- Are there new emails from the supplier asking for payments, logins or file opens?Treat these as suspect until checked by phone
- Do other suppliers depend on this one?Check for fourth-party links
Containment And Removal.
You cannot remove the listing, and you do not control the supplier. You can limit what the supplier and the attackers can reach. CISA notes that attackers can target organizations through suppliers at all tiers of the supply chain.
- Connections: pause or limit VPN tunnels, remote access and integrations to the minimum needed. Restore them only after the supplier gives you facts you accept.
- Shared secrets: change passwords, API keys, tokens and certificates the supplier holds. Remove accounts you can no longer justify.
- Supplier contact: ask the supplier in writing for the facts, and name one contact on each side.
- Mail: add warnings to messages from the supplier's domain and review mail rules for it while phishing risk is high.
- Law enforcement or national CERT: if your own data or systems are affected, report to your national police cyber unit and national CERT. In Turkiye, report through USOM (usom.gov.tr). In the United States, CISA says victims of ransomware should report to federal law enforcement via IC3 or a Secret Service field office.
- Counsel: your counsel can advise on contract rights, notices to your own customers and regulators.
Longer-Term Hardening.
NIST SP 800-161 gives guidance on managing supply chain risk at all levels of an organization. The NCSC groups its supply chain principles in four stages: understand the risks, establish control, check your arrangements, and keep improving. Apply that here.
- Keep a current list of suppliers with the data and access each one has.
- Give each supplier the least access it needs, and use separate accounts that you can switch off fast.
- With your counsel, write breach notice duties into supplier contracts.
- Store secrets so they can be rotated without breaking the service.
- Plan an exit route for critical suppliers.
How To Measure That It Worked.
- You can list the data and access the supplier had, and what you changed.
- Every shared secret was rotated and the date is logged.
- The supplier gave written answers to your questions, or you recorded that it did not.
- No unusual activity shows up from the supplier's accounts.
- Staff reported suspect emails instead of acting on them.
Common Mistakes.
- Waiting for the supplier to confirm. Limit access now and restore it later.
- Forgetting hidden connections. Old API keys and shared mailboxes are often missed.
- Rotating secrets but leaving the old account active. Remove or disable it.
- Trusting email from the supplier. The attacker may be writing from the real mailbox.
- Telling the supplier too little. Be clear about the data you need answers on.
- Treating it as the supplier's problem only. Your data and your customers are still at stake.
Questions.
-
What should we do if a supplier appears on a ransomware leak site?
List what data and access the supplier has, then limit or cut the riskiest connections and rotate shared secrets. Contact the supplier in writing for facts, warn staff about phishing and ask your legal counsel about notices. Do this before the supplier confirms anything.
-
Should we cut all access to the supplier?
Not always. Pause connections that give the supplier wide access or hold sensitive data. If the service is critical, limit access to the minimum and watch it closely. Restore full access only when the supplier provides facts you can accept.
-
What questions should we ask the supplier after a leak site listing?
Ask whether it confirmed an incident, which of your data and systems were affected, the date range, and how the attacker got in. Ask what it has reset and whether it told law enforcement. Request written answers and keep them.
-
Which secrets should we rotate?
Rotate anything the supplier can read or store: passwords, API keys, access tokens, certificates and service account credentials. Start with those that reach sensitive data. Remove accounts you no longer need, rather than only changing their passwords.
-
How can leaked supplier data be used against us?
Attackers can use stolen emails, contacts and invoices to write phishing that looks like it comes from the supplier. They may ask for payments, logins or file opens. Tell staff to confirm such requests through another channel.
Sources
This page is general security guidance. It is not legal advice. Notification duties and takedown rights depend on your country, your contracts and the facts of the case, so ask your legal counsel before you act on them.