Cyber Incident Victim: Norigine
Date:
Nov 2022
Location:
Italy
Summary
An Italian pharmaceutical company, Norigine, was compromised by the Kelvin Security cyber gang, resulting in the theft of 3.15GB of sensitive documents including PDFs, DOCX files, and spreadsheets. The attackers publicly claimed responsibility on Breach Forums and promoted the breach through their Telegram channels, exposing internal corporate data. The victim, described as a European pharmaceutical leader, had portions of its stolen information disseminated by the threat group as part of the intrusion campaign.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around November 11, 2022, the Italian company Norigine suffered a cybersecurity incident involving unauthorized access to its systems by the threat group Kelvin Security. The attackers successfully exfiltrated approximately 3.15 gigabytes of data from Norigine's network infrastructure. The compromised data consisted of various business documents stored in common file formats including PDF, DOCX, and XLS files. Kelvin Security publicly claimed responsibility for the intrusion through a post published on Breach Forums, a known cybercrime forum frequently used for advertising data breaches and coordinating malicious activities. The group subsequently reinforced their claim by sharing details of the breach through their Telegram communication channels, expanding the visibility of the incident beyond specialized criminal forums to broader messaging platforms.
The publication of stolen Norigine data on these platforms exposed sensitive corporate information to potential misuse, though specific details about document contents weren't disclosed in the gang's announcements. Norigine's website identified the organization as a European pharmaceutical specialist, indicating the compromised data likely contained materials relevant to pharmaceutical operations, business communications, or financial records. The incident represented a continuation of Kelvin Security's pattern of targeting corporate entities, with the group leveraging both established cybercrime forums and encrypted messaging apps to publicize their activities. No information regarding Norigine's detection methods, incident response timeline, containment measures, or post-breach remediation efforts was disclosed in available reporting. The confirmed consequences remained limited to the unauthorized data access and subsequent publication by the threat actors, with no additional details about operational disruptions, financial losses, or regulatory impacts provided in source materials.