Emerging ransomware group Brain Cipher has claimed responsibility for a supposed cyber-attack on Deloitte UK, alleging it has exfiltrated over 1TB of compressed data.

The group has issued a deadline of December 15 for the company to respond. While the breach remains unverified, Brain Cipher has listed Deloitte UK as a victim on its dark web data leak site.

Deloitte has yet to confirm or deny the claim.

Brain Cipher, which appeared in June 2024, has quickly built a reputation for aggressive tactics, including targeting critical industries such as healthcare, education, and government entities. Known for leveraging LockBit 3.0-based ransomware, the group employs phishing and spear-phishing as entry points before deploying its payload.

It has already orchestrated high-profile attacks, including a disruptive breach of Indonesia’s National Data Center earlier this year, which severely disrupted public services such as immigration processing and new student registration systems.

Recommended reading

• New Report Highlights Collabs Between Nation-states, Cyber-crime Rings
• NCSC Issues Warning Over Iran Spear-Phishing Attacks
• 67% of Healthcare Organisations Hit by Ransomware In the Past Year

In a statement, Brain Cipher criticised Deloitte’s cybersecurity practices, claiming the company neglected “elementary points” of information security.

The group further hinted at persistent access to Deloitte’s systems, stating, “We are still using [tools] there today.” Brain Cipher promised to disclose evidence of alleged failures in Deloitte’s security protocols, suggesting that “the fundamentals of computer security were not respected” and claiming they would provide examples of how they bypassed the firm’s defenses.