Ragnar Locker gang steals vast amounts of personal data from Belgian Police servers

The notorious Ragnar Locker ransomware recently published a large trove of data, claiming it belonged to the Belgian municipality of Zwijndrecht. It later turned out that the data belonged to the Zwijndrecht police, a local police unit in Antwerp, Belgium.

The leaked data included thousands of car number plates, speeding fines, crime report files, personnel details, and investigation reports. It exposed people who reported crimes or abuse and can be used by malicious actors to compromise ongoing law enforcement operations and investigations.

According to local Belgian news outlets, the Ragnar Locker ransomware gang exposed Zwijndrecht police data from 2006 until September 2022, making it one of the most significant data breaches in the country.

Zwijndrecht Police have acknowledged the security incident and have blamed it on human error. The police also said that threat actors only gained access to a part of the server that stored information about administrative work and staff members.

“It is not the case that all data has been leaked. This network mainly contains personal information from our staff, such as personnel lists and photos from personnel parties,” Chief of police at Zwijndrecht, Marc Snels, told Belgian local news portal, VRT news.

“But it is true that there is sometimes sensitive information on that network, even though we always try to put it only on the professional network. Those are human errors. For example, fines and PVs have also been leaked. Also, photos of child abuse. That is very painful, of course,” Snels added.

While the incident did not affect the national police network in Belgium, the data breach did affect thousands of individuals in the local area of Zwijndrecht. The police have confirmed that it is contacting all affected individuals.

While the chief of police did not share details as to how the threat actors gained access to its internal network, he said, “We must allow the judicial investigation to proceed in complete serenity. I can say that, contrary to what is claimed, we immediately closed the systems and contacted the competent authorities. Our staff received new passwords.

“We are now also busy contacting the people whose information has been leaked. They have also been warned, should they ever be contacted,” Snels added.

The Ragnar Locker ransomware gang is one of the most notorious ransomware groups of the decade. In September, the group claimed responsibility for a cyber attack on Portuguese state-owned airline TAP Air Portugal, refuting the company’s claims about no customer data being compromised.

“Several days ago, Tap Air Portugal made a press release where they claimed with confidence that they successfully repelled the cyber attack and no data was compromised (but we do have some reasons to believe that hundreds of Gigabytes might be compromised),” reads a message, the gang published on its leak site.

“Now try to guess what happens if someone (guess who?) will provide the huge amount of irrefutable evidence, which will show that official statement of Tap Air – is not true. The incident that occurred with them on Friday – in terms of the compromised personal data scale, it exceeds even the incident with company Easy jet,” the gang added.

The group also published a screenshot of data stolen from TAP’s servers as proof of its latest exploit. The screenshot displayed the names, dates of birth, emails, addresses, phone numbers, corporate IDs, travel information, nationality, gender, and other personal information of TAP Air’s passengers.