Cyber Incident Victim: Bailly Creat
Date:
Nov 2020
Location:
France
Summary
A French pharmaceutical laboratory was compromised by the Doppel ransomware group, which infiltrated its systems and exfiltrated hundreds of internal documents. Unlike typical ransomware operations, no ransom demand or deadline was issued; instead, the attackers publicly released a portion of the stolen data months after the initial breach, likely after determining payment would not occur. The remaining data may have been sold to other threat actors, exacerbating potential impacts from the unauthorized disclosure of sensitive corporate information.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The Bailly Creat incident involved a cyberattack by the Doppel ransomware group against the French pharmaceutical laboratory, with initial infiltration occurring around November 2020. Attackers compromised at least one company computer system and exfiltrated sensitive documents during their unauthorized access. The intrusion remained undetected for approximately four months until February 2021, when Doppel operatives unexpectedly published several hundred stolen files on their leak platform without prior ransom demands or countdown timers. This publication represented the final phase of their operation against the organization, as the attackers concluded payment would not be forthcoming from the victim. The data dump contained corporate documents that appeared to originate from the November breach, though the full scope of compromised systems remained unclear from available evidence.
The unauthorized disclosure exposed sensitive company information through the attackers' distribution channels, with strong indications that unreleased data may have been sold to other criminal entities. No financial demands accompanied the leak, distinguishing this incident from typical ransomware operations where decryption keys are bartered. The four-month gap between initial compromise and data publication suggested prolonged attacker access to Bailly Creat's environment. While the exact nature of exposed documents wasn't specified, their volume and corporate origin indicated potential operational, intellectual property, or confidential business impacts. The laboratory faced reputational and operational consequences from having internal materials circulating in criminal ecosystems without means of recall or containment.