Ransomware Hits UK Finance Firm Wilson Tarquin

Incident Date: Oct 25, 2024

Attack Overview
VICTIM
Wilson Tarquin
INDUSTRY
Finance
LOCATION
United Kingdom
ATTACKER
Killsec
FIRST REPORTED
October 25, 2024

Ransomware Attack on Wilson Tarquin: A Closer Look at the KillSec Breach

Wilson Tarquin Limited, a UK-based financial services firm specializing in claims management, has recently been targeted by the notorious ransomware group KillSec. This attack has raised significant concerns about data security within the financial sector, particularly for companies involved in sensitive client interactions.

Company Profile and Industry Standing

Wilson Tarquin Limited operates in the finance sector, focusing on claims management for mis-sold financial products, such as payment protection insurance (PPI). The company, based in Manchester, UK, has been known for its aggressive marketing strategies and has faced scrutiny over its fee structures and client communication practices. Despite its challenges, Wilson Tarquin has demonstrated strong financial performance, with a reported turnover of £3.8 million and a compound annual growth rate of 15%. However, the company has been in voluntary liquidation since March 2022, indicating ongoing restructuring efforts.

Details of the Ransomware Attack

The ransomware group KillSec has claimed responsibility for the attack on Wilson Tarquin, asserting that they have obtained and are selling sensitive data for $20,000. The compromised data reportedly includes personal information such as full names, addresses, dates of birth, signatures, credit card details, and mortgage references. This breach poses significant risks to the privacy and financial security of affected individuals.

About KillSec: A Notorious Ransomware Group

KillSec, also known as Kill Security, is a ransomware group known for targeting various industries, including finance, government, and manufacturing. The group is distinguished by its use of multiple communication channels and cryptocurrency wallets, specifically Monero, to conduct its operations. KillSec has been active in several countries, including the UK, and is known for demanding substantial extortion amounts from its victims.

Potential Vulnerabilities and Attack Vectors

While specific details of how KillSec penetrated Wilson Tarquin's systems remain unclear, the company's ongoing restructuring and voluntary liquidation status may have contributed to vulnerabilities. Companies in financial distress often face challenges in maintaining effective cybersecurity measures, making them attractive targets for threat actors. Additionally, the sensitive nature of the data handled by Wilson Tarquin could have made it a lucrative target for ransomware groups seeking financial gain.

Sources

See Halcyon in action

Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!

1
2
3
Let's get started
1
1
2
3
1
1
2
2
3
Back
Next
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.