AJU Pharm Co., Ltd. targeted in alleged data breach by Beast ransomware group

• Ransomware group: Beast
• Country: South Korea
• Sector: Healthcare
• Announcement date: February 24, 2026

Beast ransomware group claims data theft from AJU Pharm Co., Ltd.

The threat actor group known as Beast has published an announcement on their leak site claiming to have compromised the internal systems of AJU Pharm Co., Ltd., a healthcare company based in South Korea. According to the post, the group has exfiltrated a significant amount of data, which they claim to have stolen as part of their operation.

The announcement, which appeared on the group's leak site on February 24, 2026, alleges that the breach occurred much earlier, with a claimed attack date of March 27, 2024. While ransomware groups often use leak sites to pressure victims through double extortion—a tactic where stolen data is threatened with public release to force ransom payments—the specific ransom demand for this incident has not been disclosed.

Details of the alleged data exfiltration

The Beast group has provided evidence to support their claims by posting screenshots of various file directories. These visual proofs appear to show the contents of the company's internal systems, including various operational and administrative files. The threat actors claim that the total volume of the stolen data amounts to 150 GB.

Based on the screenshots provided by the group, the following types of information are allegedly included in the leak:

• Supply chain documents
• GMP (Good Manufacturing Practice) audit reports
• Internal communications
• Operational documents

The presence of such documents suggests that the attackers may have gained access to sensitive administrative and procedural information necessary for the company's day-to-day operations and regulatory compliance.

Potential risks and regulatory implications

This alleged breach poses significant risks to the organization, particularly regarding its intellectual property and trade secrets. The exposure of internal operational documents and audit reports could provide competitors or other malicious actors with insights into the company's proprietary processes and business methodologies.

Furthermore, because the affected organization operates within the healthcare sector, this incident may trigger specific legal and regulatory obligations. In South Korea, the Personal Information Protection Act (PIPA) governs how sensitive data must be handled and protected. If the stolen data contains personal information, the company may face mandatory reporting requirements and regulatory scrutiny under this framework.

There is also a secondary risk involving the supply chain. The exposure of supply chain traceability checklists and related documents could facilitate highly targeted phishing attacks against the company's business partners. By understanding the company's logistics and vendor relationships, attackers can craft more convincing social engineering campaigns to compromise the broader supply chain.

Defensive considerations for the healthcare sector

While public information regarding the Beast group remains limited and their specific tactics and motivations have not been fully analyzed, this incident highlights the ongoing threats facing the healthcare industry. Organizations in this sector often handle highly sensitive data, making them a primary target for sophisticated threat actors.

To mitigate such risks, organizations are generally advised to review their security posture and implement robust monitoring to detect unauthorized access to internal directories. In response to a potential breach, it is often necessary for organizations to notify affected parties and conduct thorough forensic investigations to determine the full scope of the exposure. Maintaining strict access controls and ensuring that supply chain documentation is heavily protected are critical components of a modern cybersecurity defense strategy.