Data Is the New Diamond: Heists in the Digital Age

Unit 42 argues that financially motivated criminals in the digital age use social engineering and intensive reconnaissance to achieve their goals, linking modern data theft extortion to the February 2023 Antwerp Diamond Centre heist in Belgium where more than $100 million worth of gems were stolen by five criminals.

The mastermind, Leonardo Notarbartolo, spent considerable time on reconnaissance and social engineering, even signing a lease for an office at the site while posing as a multilingual gem importer from Italy. On the digital side, June 2025 data extortion activity designed to compromise and steal data from Salesforce instances uses voice-based phishing to establish initial access, followed by extensive reconnaissance and collection of customer‑centric data before exfiltration and ransom threats, according to Google.

Since December 2024, Unit 42 notes this data theft extortion has impacted aviation, financial services, technology and especially retail sectors, with UNC6040 linked to initial access and internal reconnaissance and Bling Libra (aka ShinyHunters) responsible for the extortion. Unit 42 also observes that 23% of social engineering-based incidents involve callback or voice-based techniques.