Cargills Bank listed on Hunters International leak site

• Ransomware group: Hunters
• Country: Sri Lanka
• Sector: Financial Services
• Announcement date: March 20, 2025

Hunters International claims data exfiltration from Cargills Bank

The threat actor known as Hunters International has listed Cargills Bank on its leak site. The group claims to have successfully exfiltrated data from the institution, marking a targeted allegation against a prominent entity within the financial services sector.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. In many modern cyberattacks, threat actors employ a tactic known as double extortion. In this scenario, the attackers do not merely encrypt a victim's files to disrupt operations; they also steal sensitive information before the encryption process begins. By threatening to release this stolen data publicly on a leak site, the attackers aim to increase the pressure on the organization to comply with their demands.

Details of the alleged attack

According to the announcement made on March 20, 2025, the Hunters International group claims that data has been exfiltrated from Cargills Bank. Notably, the group stated that their activities did not involve the encryption of the institution's systems, focusing instead on the theft of information.

The announcement was made on the same day as the claimed attack date, which was March 20, 2025. While the listing confirms the group's intent to publicize the breach, the specific details regarding the technical execution of the exfiltration remain undisclosed by the threat actor.

Data involved in the claim

Regarding the specifics of the breach, there is no detailed information regarding the nature of the exfiltrated data; no screenshot has been provided to substantiate the claim.

About Cargills Bank

Cargills Bank is a commercial bank based in Sri Lanka. The institution provides a variety of financial services, including retail and corporate banking services, credit cards, and digital banking solutions.

Impact and industry implications

This situation may pose a risk to the confidentiality of the institution's customer data and could impact the trust environment within the financial sector. The allegedly exfiltrated data could potentially be utilized for identity theft or targeted phishing attacks. Information regarding the Hunters International group is limited, and there are reports suggesting that the group ceased encryption activities as of 2025.

Because of the potential for data misuse, the institution may face legal obligations under local data protection regulations due to the potential data breach. Organizations operating within the financial sector often implement various defensive measures to mitigate such risks, such as robust encryption for data at rest and in transit, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized data transfers.

The incident highlights the ongoing challenges faced by financial institutions in securing sensitive customer information against sophisticated threat actors. As attackers shift their focus toward data exfiltration rather than traditional encryption, the importance of data loss prevention and strict access controls becomes increasingly critical for maintaining institutional integrity and customer trust.