COROB listed on Hunters International leak site

• Ransomware group: Hunters
• Country: Italy
• Sector: Manufacturing
• Announcement date: January 11, 2025

Hunters International claims data breach at COROB

The Hunters International ransomware group has listed the Italian-based manufacturing company COROB on its leak site. According to the announcement made on January 11, 2025, the group claims to have exfiltrated a significant amount of data from the organization's network. This type of activity is characteristic of modern ransomware operations, where threat actors move beyond simple encryption to a double extortion model. In such scenarios, attackers not only lock the victim's systems but also steal sensitive information to pressure the organization into paying a ransom by threatening to release the data publicly.

The group responsible for this claim, Hunters International, is a structure that emerged in 2023. Cybersecurity assessments suggest that the group is linked to the Hive ransomware code. This connection is significant for threat intelligence, as it helps analysts understand the potential tactics, techniques, and procedures that might be employed during such an attack.

Details of the claimed data exfiltration

While the exact content of the leaked data has not been specified by the attackers, the group has provided specific metrics regarding the scale of the alleged breach. The announcement includes a screenshot that supports their claims regarding the volume of information involved. The group asserts that the stolen data consists of a massive amount of information, which could pose significant risks to the target organization.

The specific details provided by the group regarding the stolen data include:

• Total data size of 4.3 TB
• Total file count of approximately 1,980,154 files

The listing does not specify the exact types of files or the specific nature of the information contained within these millions of files. In many ransomware incidents, such large volumes of data can include a variety of sensitive materials, ranging from internal corporate documents to technical specifications or employee records, though the specific categories remain unconfirmed in this instance.

About COROB

COROB is an Italian-based technology company that operates within the manufacturing sector. The organization specializes in the production of automatic dispensing and mixing systems designed for the paint, coatings, and ink industries. Furthermore, the company provides color management solutions and specialized equipment to a global market.

Risk assessment and industry implications

The claim of a data breach of this magnitude carries several potential consequences for the organization. The exposure of such a large volume of data may result in the compromise of sensitive corporate information and private employee data. Because COROB is based in Italy, any confirmed data breach could trigger legal processes and sanctions under the General Data Protection Regulation (GDPR), which governs data privacy and protection within the European Union.

Furthermore, the involvement of the Hunters International group introduces additional risks. Given the group's past activities, there is a possibility that the leaked data could be utilized in secondary attacks or for identity theft attempts against individuals associated with the company. For a company operating in the manufacturing sector, such a breach can also pose significant risks to supply chain security, as disruptions or data leaks can impact partners and customers within the production ecosystem.

To mitigate these types of risks, organizations in the manufacturing sector often implement various defensive measures. These include robust network segmentation to prevent lateral movement by attackers, comprehensive encryption for data at rest and in transit, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, maintaining a strict patch management schedule and conducting regular security awareness training for employees are fundamental steps in reducing the attack surface against ransomware groups.