What We Do
How We Do
Get Started

Key Learnings from the Tempur Sealy Ransomware Attack

BY eSentire

September 21, 2023 | 6 MINS READ


Cyber Risk

Endpoint Protection

Managed Detection and Response


Cybersecurity Strategy

Want to learn more on how to achieve Cyber Resilience?


For members of the notorious ALPHV, also known as BlackCat, ransomware group, it’s been some great few months. For the security and business leaders at Tempur Sealy, one of the largest mattress and bedding manufacturers in the world, not so much.

On July 23, 2023, the CEO of Tempur Sealy reported that a cyberattack had shuttered the company’s business operations after ALPHV infiltrated the company’s IT environment. The news about Tempur Sealy follows on the heels of the cyberattack targeting Estée Lauder Companies, the second-largest cosmetics company globally.

In both cases, the ALPHV ransomware group claimed responsibility in a post on a Dark Web message forum and even shared a sampling of sensitive documents they exfiltrated, such as customers’ banking information, shipping addresses, order details, and even coupon usage. In the case of Tempur Sealy, the reason behind sharing the sample documents was a brazen move to force the company to publicly disclose the cyberattack.

Of course, the impact on Tempur Sealy was undoubtedly significant:

Who is the ALPHV / BlackCat Ransomware Group?

The ALPHV/BlackCat ransomware is developed and operated as a ransomware-as-a-service (RaaS) by a group known as Alpha Spider. Additionally, based on further research from our Threat Response Unit (TRU), the top targeted sectors observed have been legal, business services, software, finance, healthcare, and manufacturing.

In many cases, ALPHV uses triple extortion to force its targets to do its bidding and pay the ransom; if the victims don’t take action, the group threatens to leak the exfiltrated data to the public and even disrupt operations further by conducting Distributed Denial of Service (DDoS) attacks.

The Canadian Centre for Cyber Security also issued an Alert with details on the tactics, techniques, and procedures (TTPs) used by ALPHV to deploy ransomware:

What Can You Learn from the Tempur Sealy Ransomware Attack?

While it’s unclear exactly how ALPHV managed to gain initial access into Tempur Sealy’s internal environment, it’s likely that some form of social engineering was at play here, underscoring the importance of regularly conducting managed phishing and security awareness training with your employees – even your executive leadership team.

A more important factor to consider is what kind of endpoint protection platform you have set in place, especially if your organization still uses an on-premises or hybrid environment for data storage. What’s more, you need an endpoint detection and response (EDR) solution that can protect your assets no matter where your users or data reside – in the cloud, mobile, virtual, or physical environments.

This also means you need to pay closer attention to your EDR solution provider and evaluate the tools and technologies they’re using to protect your assets. In their Dark Web forum message, ALPHV went so far as to single out Tempur Sealy’s incident response and MDR provider, Arctic Wolf, and even singled out that Arctic Wolf’s endpoint agent is a “rebranded OSSEC” (i.e., an open-source host-based intrusion detection system).

A message posted on a Dark Web forum by ALPHV/BlackCat ransomware group after compromising the security for Tempur Sealy.
Image source: Dominic Alvieri / X

Unfortunately, OSSEC itself comes with its own set of challenges:

Notes from eSentire’s Threat Response Unit (TRU):

  • Our 24/7 SOC Cyber Analysts, in addition to TRU, have implemented detections for the ALPHV/BlackCat ransomware. More importantly, we also have capabilities to detect and contain some of the more common attack vectors and precursor malware associated with this threat actor group.
  • TRU has observed and stopped 100+ attacks across our global customer base involving malware that is a precursor to ALPHV/BlackCat ransomware; about 35% of these have been in 2023.

Recommendations to Prevent and Mitigate Ransomware Attacks

Preventing the various attack technique and tactics utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detections, and the ability to investigate logs & network data during active intrusions. 

We recommend implementing the following controls to help secure your organization against BlackCat ransomware attacks: 

There is no guarantee that your organization will never be targeted by a ransomware attack. This is why it’s important to have the right security provider by your side – one with a team of 24/7 SOC Cyber Analysts and Elite Threat Hunters – who can help you anticipate, withstand, and recover from the toughest cyberattacks.

To learn how eSentire MDR can help you build a more resilient security operation, connect with an eSentire cybersecurity specialist.


eSentire, Inc., the Authority in Managed Detection and Response (MDR), protects the critical data and applications of 2000+ organizations in 80+ countries, across 35 industries from known and unknown cyber threats by providing Exposure Management, Managed Detection and Response and Incident Response services designed to build an organization’s cyber resilience & prevent business disruption. Founded in 2001, eSentire protects the world’s most targeted organizations with 65% of its global base recognized as critical infrastructure, vital to economic health and stability. By combining open XDR platform technology, 24/7 threat hunting, and proven security operations leadership, eSentire's award-winning MDR services and team of experts help organizations anticipate, withstand and recover from cyberattacks. For more information, visit: www.esentire.com and follow @eSentire.

Read the Latest from eSentire