ATL Leasing listed on Hunters International ransomware leak site

• Ransomware group: Hunters
• Country: Tunisia
• Sector: Financial Services
• Announcement date: March 15, 2024

The Hunters International ransomware group has listed the Tunisian financial services company ATL Leasing on its dedicated leak site. According to the announcement, which became visible on the platform on March 15, 2024, the group claims to have successfully compromised the institution's systems, alleging that data was both encrypted and exfiltrated during the attack.

The claimed attack and event details

The incident involving ATL Leasing is characterized by the ransomware group as a successful breach of the organization's digital infrastructure. The group alleges that they gained unauthorized access to the systems of the Tunisian institution, leading to a dual-threat scenario common in modern cyberattacks. This involves both the encryption of critical files to disrupt business operations and the exfiltration of sensitive information to be used for further leverage.

While the announcement appeared on the leak site on March 15, 2024, the group claims the actual attack took place on March 12, 2024. This discrepancy between the date of the breach and the date of the public announcement is a common occurrence in ransomware operations, as attackers often take time to navigate networks and prepare their extortion demands or public pressure tactics.

Data volume and content

The scale of the data allegedly stolen by the Hunters International group is significant. Based on the information provided on the leak site, the group claims to have exfiltrated a dataset with the following characteristics:

• Total data size: 162.1 GB
• Total file count: 157,837 files

Regarding the specific nature of the information, the listing does not provide a detailed breakdown or a specific list of the types of data shared. There is no information available regarding whether the files contain customer identities, financial records, or internal corporate documents.

About ATL Leasing

ATL Leasing is a financial leasing company headquartered in Tunisia. The organization operates within the financial services sector, providing various leasing solutions to both businesses and individuals. Their service portfolio includes leasing options for equipment, vehicles, and real estate, making them a key player in the regional financial landscape for asset acquisition.

Impact and strategic assessment

The actions taken by the Hunters International group could have serious implications for the institution. Such an event may negatively impact the operational continuity of the organization and poses a significant risk regarding the exposure of financial data. Depending on the specific content of the allegedly exfiltrated data, there is a potential risk of identity theft or the execution of targeted phishing attacks against the company's customers.

Furthermore, the institution may face legal obligations under the framework of Tunisia's data protection legislation following such a breach. The group's history is also a factor in assessing the risk; Hunters International emerged in 2023 and is assessed to use the Hive codebase. This association suggests a risk that the data could be made public as part of a double extortion method, where attackers threaten to release sensitive information if a ransom is not paid.

Interestingly, while the group has been active with these methods, reports that the group ceased encryption activities in 2025 may suggest a shift in the group's overall strategy. In the broader context of cybersecurity, organizations in the financial sector often employ defensive measures such as multi-factor authentication, regular offline backups, and network segmentation to mitigate these types of risks. Ransomware leak sites serve as a tool for public pressure, and the transition from simple encryption to data exfiltration and public leaking represents a sophisticated evolution in cyber extortion tactics.