Custom Security Systems listed on Hunters International leak site

• Ransomware group: Hunters
• Country: United States
• Sector: Professional Services
• Announcement date: September 5, 2024

Hunters International claims data breach at Custom Security Systems

The threat actor known as Hunters International has listed Custom Security Systems on its dedicated leak site. According to the announcement made on September 5, 2024, the group claims to have successfully exfiltrated a significant volume of data belonging to the organization. This incident highlights the ongoing trend of data exfiltration-focused attacks by sophisticated ransomware groups.

Ransomware leak sites serve as a public platform where cybercriminals post information about their victims to pressure them into paying ransoms. These sites often include details about the scale of the breach to increase the psychological impact on the target organization. In this instance, the group has moved to publicize the alleged theft, signaling a potential shift in their operational tactics.

Details of the alleged exfiltration

The claims made by Hunters International regarding the attack on Custom Security Systems involve a substantial amount of stolen information. The group asserts that the attack occurred on September 5, 2024, the same day the announcement was posted to their leak site. The group claims to have exfiltrated approximately 385,831 files from the organization's systems.

The total volume of the data allegedly stolen is estimated at 152.3 GB. Notably, the group has stated that the data was not encrypted during the incident; rather, it was exfiltrated directly from the target's environment. This method of attack focuses on the theft of information rather than the traditional method of locking files through encryption, though the group's history suggests a complex relationship with such tactics.

Scope of the stolen data

The announcement made by the threat actor mentions that the stolen information consists of 'entire company data.' However, the group has not provided any specific details regarding the types of files or the nature of the information contained within the 152.3 GB of data. Consequently, the listing names no specific data types.

About Custom Security Systems

Custom Security Systems is an American company operating within the professional services sector. The organization provides a variety of security solutions designed for both residential and commercial properties. Their service portfolio includes the implementation and management of alarm systems, video surveillance, and access control technologies.

Analysis and potential risks

This incident may result in the exposure of the organization's operational data and sensitive information. As a US-based entity, any potential data breach may fall under the scope of state-level data protection laws and regulations. The legal implications for companies in the United States often depend on the specific nature of the data lost and the jurisdiction in which the affected individuals reside.

The Hunters International group is assessed to be derived from the Hive ransomware code. Because of this lineage, it is possible that the group has adopted double-extortion tactics. Double extortion is a strategy where attackers not only encrypt a victim's data to disrupt operations but also steal sensitive information to threaten its public release. This creates two layers of pressure: the need to restore systems and the need to prevent a data leak.

Furthermore, reports suggesting that the group ceased encryption activities in 2025 may indicate that their focus has shifted toward data exfiltration and extortion. This shift suggests a move toward a model where the primary leverage is the threat of exposing sensitive information rather than the immediate disruption of IT services. For organizations, this means that even if backups are available to restore systems, the threat of a leak remains a critical risk.

Secondary risks following such a breach may emerge for the organization's customers and employees, including the potential for identity theft or targeted phishing attacks. When sensitive data is leaked, attackers often use it to craft highly convincing social engineering campaigns. Organizations in the professional services and security sectors can mitigate these risks by implementing robust data loss prevention measures, maintaining strict access controls, and ensuring comprehensive monitoring of data movement to detect exfiltration attempts early.