{
	"id": "b471c418-d3bb-4753-8552-75109b5011da",
	"created_at": "2026-04-06T00:16:07.722034Z",
	"updated_at": "2026-04-10T03:26:37.758294Z",
	"deleted_at": null,
	"sha1_hash": "61639438b615372113f97747b6dbef9769d5c6bc",
	"title": "Irish foreign affairs ministry says ‘no evidence’ of cyber breach following extortion claim",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 82067,
	"plain_text": "Irish foreign affairs ministry says ‘no evidence’ of cyber breach\r\nfollowing extortion claim\r\nBy Alexander Martin\r\nPublished: 2024-02-28 · Archived: 2026-04-02 12:13:35 UTC\r\nIreland’s Department of Foreign Affairs (DFA) said there was currently “no evidence of any breach” of its IT\r\nsystems following a claim by a new cyber extortion group that it had stolen data and was prepared to sell it.\r\nThe new group, calling itself Mogilevich, listed the DFA on Tuesday, claiming to offer 7GB of compromised\r\ndocuments for sale. The group did not provide any evidence supporting its claims of having breached the\r\ndepartment.\r\nThree other victims are listed on Mogilevich’s extortion site. Recorded Future News is not publishing their names\r\nas these companies have not responded to requests for comment. The group provided no evidence for the other\r\nbreaches, which are also unsupported by any public evidence.\r\nIn a statement, a spokesperson for the DFA said the department was “notified by Ireland’s National Cyber Security\r\nCentre (NCSC) on Tuesday evening (27 February) of a potential cybersecurity incident.”\r\nThey added that the DFA “has been working closely with the NCSC to establish whether this allegation is\r\nauthentic.”\r\nSo far, they said “there is no evidence of any breach of DFA ICT security infrastructure. The Department, in\r\nconjunction with the NCSC, will continue its investigation and, should any breach be identified, will address any\r\nissues that arise around information held by the Department.”\r\nThere are a number of indications that the Mogilevich group is inauthentic. Unlike the extortion sites used by\r\nestablished ransomware-as-a-service groups, Mogilevich’s site is amateurishly designed.\r\nThe group also requests a $1,000 deposit from potential affiliates — something likely to provoke enormous\r\nsuspicion among professional fraudsters.\r\nFraudulent ransomware gangs are an established occurrence in the cybercrime world. Back in 2019, cybersecurity\r\ncompany Coveware named the phenomenon “Phantom Incident Extortion” in a report detailing the scam.\r\nSuch scammers are the bottom-feeders of the ransomware world, lacking both the capabilities to gain initial access\r\nto a victim’s network and then the platform to monetise that access — despite how significantly the cybercriminal\r\necosystem has lowered the bar for both.\r\nhttps://therecord.media/ireland-dfa-no-evidence-of-cybersecurity-breach\r\nPage 1 of 2\n\nAlexander Martin\r\nis the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow\r\nat the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal\r\non: AlexanderMartin.79\r\nSource: https://therecord.media/ireland-dfa-no-evidence-of-cybersecurity-breach\r\nhttps://therecord.media/ireland-dfa-no-evidence-of-cybersecurity-breach\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia"
	],
	"references": [
		"https://therecord.media/ireland-dfa-no-evidence-of-cybersecurity-breach"
	],
	"report_names": [
		"ireland-dfa-no-evidence-of-cybersecurity-breach"
	],
	"threat_actors": [
		{
			"id": "52b3d0a8-3a0f-4a94-a34b-adbfb804ea0c",
			"created_at": "2024-03-02T02:00:03.836076Z",
			"updated_at": "2026-04-10T02:00:03.599619Z",
			"deleted_at": null,
			"main_name": "Mogilevich",
			"aliases": [],
			"source_name": "MISPGALAXY:Mogilevich",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434567,
	"ts_updated_at": 1775791597,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/61639438b615372113f97747b6dbef9769d5c6bc.pdf",
		"text": "https://archive.orkl.eu/61639438b615372113f97747b6dbef9769d5c6bc.txt",
		"img": "https://archive.orkl.eu/61639438b615372113f97747b6dbef9769d5c6bc.jpg"
	}
}