Costex listed on Hunters International leak site

• Ransomware group: Hunters
• Country: United States
• Sector: Manufacturing
• Announcement date: January 11, 2025

Hunters International claims data breach at Costex

The threat group known as Hunters International has listed Costex on their leak site, claiming to have compromised the company's data. According to the announcement made on January 11, 2025, the group alleges that they have successfully exfiltrated and encrypted information belonging to the organization.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on victims through a tactic known as double extortion. In such scenarios, attackers do not merely encrypt a company's systems to disrupt operations; they also steal sensitive information to threaten its public release. This dual-threat approach aims to maximize the likelihood of a ransom payment by targeting the victim's reputation and regulatory compliance standing.

The activity reported by the group is claimed to have occurred on January 11, 2025. While the group has published this announcement, the specific details regarding the method of entry or the exact nature of the breach remain undisclosed in the public listing.

Details of the claimed data exfiltration

The listing provided by Hunters International makes significant claims regarding the scale of the data they have allegedly stolen from Costex. The group asserts that the breach involves a massive volume of information, which could pose a substantial risk to the organization's digital assets and intellectual property.

The specific details provided by the attackers include the following:

• Total data size: 3.8 TB
• Total file count: 1,481,005 files

While the attackers have provided these metrics regarding the volume and quantity of the files, the specific nature of the exfiltrated data has not been disclosed. The listing does not specify whether the files contain financial records, proprietary designs, or internal communications, leaving the exact contents of the 3.8 TB dataset unknown.

About Costex

Costex Corporation (CTP) is a global manufacturer and distributor of replacement parts for heavy equipment. The company provides high-quality aftermarket parts for machinery brands such as Caterpillar. Operating within the manufacturing sector, the company maintains a significant presence in the global supply chain for heavy machinery maintenance and repair.

Risk assessment and industry implications

Hunters International is assessed to have emerged in 2023 and is believed to utilize code derived from the Hive ransomware. This incident may negatively impact the company's operational continuity and could lead to the exposure of trade secrets and employee records. As the entity is based in the US, the incident may be subject to state-level data breach notification laws and potential federal regulations.

The group's reported cessation of encryption activities suggests a potential shift toward data-extortion-only tactics. This shift is a growing trend in the ransomware landscape, where attackers focus on the theft and threat of leaking data rather than the technical disruption of systems through encryption. This method can be more efficient for attackers and harder for traditional defensive measures to detect until the data is already exfiltrated.

Secondary risks associated with this incident include the possibility that the leaked data could be leveraged for identity theft or targeted phishing campaigns. When large datasets are leaked, they often become fuel for subsequent social engineering attacks, where criminals use stolen information to impersonate employees or customers.

Organizations in the manufacturing sector can take several defensive steps to mitigate these risks. Implementing robust data loss prevention (DLP) tools can help detect unauthorized transfers of large volumes of data. Furthermore, maintaining strict network segmentation can prevent attackers from moving laterally from an initial point of entry to sensitive data repositories. Regular audits of access controls and the implementation of multi-factor authentication (MFA) across all external-facing services remain critical components of a modern cybersecurity posture.