ach.co.th targeted by RansomHub in alleged data breach

• Ransomware group: RansomHub
• Country: Thailand
• Sector: Professional Services
• Announcement date: July 26, 2024

RansomHub claims compromise of ach.co.th

The ransomware group known as RansomHub has published a leak announcement on its dedicated leak site, claiming to have compromised data belonging to the organization ach.co.th. This announcement, posted on July 26, 2024, follows an alleged attack that occurred on July 23, 2024. The threat actor claims to have successfully breached the organization's infrastructure, leading to the potential exposure of sensitive internal information.

According to the claims made by the threat actor, the group gained unauthorized access to the organization's servers. The group asserts that they have not only encrypted files within the network but have also exfiltrated private information. This tactic is a hallmark of modern ransomware operations, often referred to as double extortion, where attackers threaten to release stolen data to pressure victims into paying a ransom.

The group has stated that if the ransom demand is not met, they intend to leak a variety of sensitive materials. While the specific ransom amount has not been disclosed, the group has explicitly threatened to release several categories of data to the public. These categories include:

• Private documents
• Databases
• Webmails
• Source code

Organization profile

ACH Co., Ltd. is a professional services and consulting firm based in Thailand. The company provides specialized services across various industrial and commercial sectors, serving as a provider of expertise to a wide range of clients.

Impact and analysis of the incident

This incident may lead to significant disruptions in the organization's operational continuity. The alleged exfiltration of databases and webmails could pose secondary risks such as identity theft or targeted phishing attacks against employees and customers. Furthermore, the organization may face legal obligations under Thai data protection regulations following the alleged breach.

The group involved, RansomHub, is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. It is reported that the group absorbed affiliates from the ALPHV group. According to reports, the group is said to have ceased operations in early 2025.

In general, ransomware attacks of this nature present multifaceted challenges for organizations. When attackers gain access to source code and databases, the integrity of the company's intellectual property and client data is directly threatened. The threat of leaking webmail communications can also lead to sophisticated social engineering campaigns, where attackers use stolen context to deceive employees or clients.

To defend against such threats, organizations in the professional services sector often implement various defensive measures. These include maintaining robust backup solutions that are isolated from the main network to ensure recovery, implementing multi-factor authentication across all services, and maintaining strict monitoring of network traffic to detect unauthorized data exfiltration. Additionally, regular security training for employees can help mitigate the risks associated with phishing and other social engineering tactics that often follow a data breach.

Summary of the claim

The announcement by RansomHub focuses on the compromise of private documents, databases, webmails, and source code. No information was provided regarding the specific size of the data stolen or the total file count involved in the breach.