Corantioquia listed on Hunters International ransomware leak site

• Ransomware group: Hunters
• Country: Colombia
• Sector: Government & Defense
• Announcement date: May 27, 2025

Hunters International claims attack on Corantioquia

The Hunters International ransomware group has published a notice on its leak site claiming the exfiltration of data belonging to Corantioquia. This announcement, made public through the group's own platform, marks a significant development in the ongoing threat landscape facing regional government entities.

According to the claims made by the threat actor, the incident involves both the theft of information and the disruption of digital operations. The group asserts that they have successfully exfiltrated data from the organization and that the target's systems have been encrypted. These allegations were officially posted by the group on May 27, 2025.

Details of the claimed breach

While the group has taken responsibility for the incident on their leak site, specific details regarding the nature of the compromised information remain unavailable. The group has not provided any specifics regarding the types of files or the specific categories of data that have been targeted during the operation.

The listing names no specific data types involved in the breach; it is only stated that data has been exfiltrated and encrypted. Consequently, the exact scope of the information loss remains unknown at this time.

About Corantioquia

Corantioquia is a regional environmental authority located in Colombia. The organization is responsible for the sustainable management of natural resources and environmental regulation within the Antioquia department. Its primary mission includes the protection of ecosystems, the management of natural resources, and the execution of various environmental enforcement activities to ensure ecological stability in the region.

Impact and threat actor profile

The claims made by Hunters International could have significant implications for the institution. This situation may have negative impacts on the organization's operational continuity, potentially disrupting the essential environmental services and regulatory functions it provides to the Antioquia department. Furthermore, the claim of a data leak could bring about the risk of exposing sensitive information within the organization, which may lead to legal obligations for the institution under Colombian data protection regulations.

Hunters International is a ransomware group that emerged in 2023. It is considered to be a derivative of the Hive codebase. Although the group has previously announced that it ceased its encryption activities as of 2025, such announcements may not eliminate the threat. Instead, they may pave the way for secondary risks and targeted phishing attacks, as the threat actor's presence in the ecosystem persists through different methodologies.

In general, ransomware attacks often involve a