Aeris Energy listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: Brazil
• Sector: Energy & Utilities
• Announcement date: November 23, 2024

Hunters ransomware group claims Aeris Energy breach

The Brazil-based company Aeris Energy has been listed on the leak site of the Hunters International ransomware group. According to the announcement made on November 23, 2024, the threat actor group claims to have successfully targeted the organization's systems.

The Hunters International group has claimed that they have exfiltrated and encrypted data belonging to Aeris Energy. The group's announcement states that the attack occurred on November 23, 2024, the same day the listing appeared on their platform. This type of public listing is a common tactic used by ransomware groups to pressure victims into paying ransoms by threatening to release sensitive information to the public.

Details of the claimed data exfiltration

While the specific contents of the leaked data have not been detailed in the announcement, the group has provided specific metrics regarding the scale of the alleged theft. The listing indicates a significant volume of information has been targeted. The group claims that the following data has been compromised:

• Total data size: 1.3 TB
• Total file count: 673,562 files

Although the group has provided these statistics, no specific details regarding the exact content or nature of the leaked data have been shared. The group has provided a screenshot that indicates a general data exfiltration has taken place, but it does not specify the types of files or the specific departments affected within the organization.

About Aeris Energy

Aeris Energy is a company based in Brazil that operates within the renewable energy sector. The organization specializes in the design, production, and maintenance of renewable energy equipment. Specifically, Aeris Energy is known for manufacturing wind turbine blades used in the wind energy industry.

Potential implications and risks

This incident suggests that operational data and sensitive information within Aeris Energy may be at risk. Depending on the actual content of the leaked data, secondary risks may arise for both employees and business partners, such as identity theft or targeted phishing attacks. Given the organization's position in the energy sector, the leak could also have broader implications for the supply chain.

Considering the past activities of Hunters International, it is assessed that the group may have employed double extortion tactics. Double extortion is a method where attackers not only encrypt an organization's data to disrupt operations but also steal the data beforehand, threatening to leak it unless a ransom is paid. This increases the pressure on the victim, as the threat of data exposure remains even if the organization can restore systems from backups.

Furthermore, under Brazil's data protection regulation, LGPD, the organization may be required to fulfill specific data breach notification obligations. Organizations facing such incidents often focus on containment, forensic investigation, and strengthening defensive measures such as multi-factor authentication and network segmentation to mitigate future risks.