Benetton Group listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: Italy
• Sector: Professional Services
• Announcement date: April 3, 2024

Hunters ransomware group claims data exfiltration from Benetton Group

The Hunters ransomware group has listed the Benetton Group on its dedicated leak site, claiming to have successfully exfiltrated a significant volume of data from the organization. According to the announcement made on April 3, 2024, the threat actor group asserts that they have obtained approximately 433.7 GB of information. While the group has claimed responsibility for the data theft, they notably stated that the organization's systems were not encrypted during the incident.

Ransomware attacks often follow a pattern known as double extortion. In these scenarios, threat actors do not merely encrypt a victim's files to disrupt operations; they also steal sensitive information before the encryption phase. This allows the attackers to threaten the public disclosure of the stolen data if a ransom is not paid, creating additional leverage over the victim. In this specific case, the group has moved directly to the disclosure phase by listing the target on their leak site.

Details of the claimed data breach

The information provided by the threat actor indicates a massive volume of stolen files. The group claims that the exfiltrated data consists of a total of 3,179,093 files. Based on the screenshots provided by the attackers, the stolen data is categorized into two primary segments: a smaller set of files labeled as 'Clients' and a much larger repository labeled as 'All Data'.

The breakdown of the claimed data is as follows:

• Clients: 33.8 MB (10 files)
• All Data: 433.7 GB (3,179,093 files)

The affected data categories identified in the leak include:

• Client data
• Corporate data

The sheer volume of files suggests a broad sweep of the organization's digital environment. When such large quantities of data are leaked, it often includes a mix of internal communications, administrative documents, and potentially sensitive information regarding business operations and customer interactions.

About Benetton Group

Benetton Group is an Italian-based global clothing and fashion company. Known for its United Colors of Benetton brand, the organization operates in the fields of textile design, manufacturing, and retail. As a major player in the global fashion industry, the company maintains complex supply chains and a vast network of retail and manufacturing operations.

Potential risks and industry implications

The potential public disclosure of the claimed data could lead to secondary risks such as identity theft and targeted phishing attacks for Benetton Group and its customers. As the organization is based in Italy, the potential data breach may be subject to the EU General Data Protection Regulation (GDPR), which could result in regulatory penalties. Furthermore, there is a possibility that the organization's supply chain partners may also be affected by this incident.

The group responsible, Hunters International, is assessed to be derived from Hive ransomware code. Given the group's past tactics, the data leak could have significant negative impacts on corporate reputation. For organizations in the professional services and retail sectors, such incidents highlight the critical importance of robust data loss prevention (DLP) strategies and comprehensive monitoring of network egress to detect unauthorized data transfers.

To mitigate such risks, organizations typically focus on implementing multi-factor authentication (MFA) across all access points, maintaining strict principle of least privilege (PoLP) for user permissions, and conducting regular security awareness training to prevent initial access via phishing. Additionally, maintaining offline, immutable backups is a fundamental defensive step to ensure operational continuity in the event of a successful encryption-based attack.