City of St. Cloud, Florida listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: United States
• Sector: Government & Defense
• Announcement date: April 16, 2024

Hunters ransomware group targets City of St. Cloud, Florida

The Hunters ransomware group has listed the City of St. Cloud, Florida, on its dedicated leak site. According to the group's announcement, the threat actors claim to have successfully exfiltrated and encrypted a significant amount of the organization's data. This public listing is a tactic used by ransomware groups to exert pressure on their targets by threatening to release sensitive information to the public.

Details of the alleged breach

The threat actor added the City of St. Cloud, Florida, to its leak site on April 16, 2024. The group claims that the attack occurred on the same day, April 16, 2024. Through this public announcement, the group is attempting to create pressure on the municipal government by making the alleged breach known to the public.

Regarding the scope of the data involved, the group claims to have stolen and encrypted a massive volume of information. Based on the information provided in the listing, the following details have been claimed by the threat actors:

• Total data size: 1.4 TB
• Total file count: 719,597 files

While the group provided a screenshot in the listing to support their claims regarding the volume of files and the total size, no detailed information regarding the specific types of data contained within these files has been provided by the attackers.

About the City of St. Cloud, Florida

St. Cloud is a municipal government located in the state of Florida, United States. The organization provides essential administrative services, public safety, and infrastructure management to its local residents.

Analysis and potential impact

The claims made by the Hunters ransomware group may pose significant risks to the organization's operational continuity and data privacy. Such breaches targeting public institutions can lead to the exposure of citizens' personal information and potentially result in secondary attacks, such as identity theft.

It is important to note that the Hunters group is assessed to be derived from the Hive ransomware codebase. Because of this connection, it can be observed that the attacks are likely conducted using double-extortion tactics. In a double-extortion scenario, attackers do not just encrypt the victim's data to disrupt operations; they also steal the data beforehand to threaten the victim with its public release, thereby increasing the pressure to pay the ransom.

For organizations in the government and defense sector, such incidents can lead to the disruption of public services and significant reputational damage. Furthermore, the organization may face various data breach notification requirements under US state laws and federal regulations following such an event.

In general, when organizations face these types of threats, maintaining robust security postures is critical. This includes implementing strong access controls, conducting regular backups, and ensuring that systems are patched against known vulnerabilities. Public institutions, in particular, must be wary of the cascading effects that a data breach can have on the trust and safety of the citizens they serve.