CAN.COM listed on Hive ransomware leak site

• Ransomware group: Hive
• Country: Netherlands
• Sector: Technology
• Announcement date: July 4, 2022

Hive ransomware group claims attack on CAN.COM

The Hive ransomware group has officially listed the technology company CAN.COM on its dedicated leak site. According to the announcement made on July 4, 2022, the threat actor group claims to have successfully gained unauthorized access to the organization's network. This development is being viewed as a potential instance of double extortion, a common tactic used by modern ransomware operations to increase pressure on their victims.

Double extortion is a sophisticated method where cybercriminals do not merely encrypt a victim's files to disrupt operations, but also exfiltrate sensitive data before the encryption process begins. By threatening to leak this stolen information on public forums or leak sites, the attackers aim to coerce the organization into paying a ransom to prevent the public exposure of their proprietary or private information. This approach significantly increases the leverage held by the attackers, as the threat of reputational damage and regulatory scrutiny often outweighs the cost of recovering from a simple system outage.

In this specific instance, the Hive group asserts that they have compromised the data belonging to CAN.COM. While the claim has been posted publicly, the incident highlights the ongoing risks faced by digital infrastructure providers in the current threat landscape.

Details regarding the alleged breach

Despite the public claim made by the Hive group, specific details regarding the nature of the breach remain limited. At this time, there is no information available regarding the specific types of data that were allegedly leaked. Furthermore, the announcement did not include any screenshots or visual evidence to substantiate the claims made by the attackers.

The listing names no specific data types or categories involved in the alleged incident.

About CAN.COM

CAN.COM is a technology company based in the Netherlands. The organization focuses on digital asset management and domain name services, operating within the critical field of internet infrastructure and online services. Given its role in providing essential digital services, the company plays a significant part in the technological ecosystem of its region.

Risk assessment and implications

This incident may pose significant risks to the organization's operational continuity and data privacy. Because CAN.COM is based in the Netherlands, the confirmation of a data breach could lead to serious legal consequences, including potential sanctions and mandatory notification obligations under the General Data Protection Regulation (GDPR). Regulatory frameworks like the GDPR are designed to ensure that organizations protect personal data and are held accountable when such protections fail.

The Hive group is known to be a Ransomware-as-a-Service (RaaS) operation that has been active since 2021. It is worth noting that the group's infrastructure was disrupted by US authorities in 2023. The leakage of an organization's data can create various secondary risks, such as identity theft or the launch of targeted phishing attacks against the company's employees and customers. Such follow-on attacks often exploit the information stolen during the initial breach to gain further access or to defraud individuals.

For organizations operating in the technology and internet infrastructure sectors, maintaining robust security postures is essential. Common defensive strategies include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security audits to identify vulnerabilities. Furthermore, ensuring compliance with regional data protection laws is a critical component of managing the legal and reputational risks associated with modern cyber threats.