DataBank listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: United States
• Sector: Technology
• Announcement date: April 3, 2024

The Hunters ransomware group has listed the United States-based technology company DataBank on its leak site. According to an announcement made on April 3, 2024, the threat actor claims to have successfully exfiltrated a massive amount of data belonging to the organization.

The details of the claim

The Hunters group asserts that they have gained unauthorized access to DataBank's systems and have stolen significant portions of their data. Based on the information provided by the group, the breach involves two distinct datasets. The first dataset, labeled as 'Clients,' is reported to contain 1.6 TB of information and consists of 3,682,718 files. The second dataset, labeled as 'All Data,' is reported to be much larger, totaling 3.5 TB and containing 10,633,996 files.

When combined, the group claims the total volume of exfiltrated data reaches 5.1 TB, encompassing a total of 14,316,714 files. While the group has publicly announced this data breach and provided screenshots to support their claim, they have not provided any information regarding encryption activities or whether any systems were locked during the incident. Furthermore, no ransom demand has been specified in the current announcement.

Affected data types

The information claimed to be stolen by the Hunters group includes various types of sensitive information. Based on the group's listing, the following categories of data are reportedly involved:

• Customer data
• Corporate data

About DataBank

DataBank is a technology company operating out of the United States. The firm specializes in providing enterprise-grade services, including data center solutions, cloud computing, and managed services. Their operations focus heavily on critical infrastructure and specialized data hosting solutions for various clients.

Analysis and potential implications

The claims made by the Hunters group pose significant risks to DataBank's operational processes and its customer base. Because the organization is based in the United States, the nature of the leaked data may trigger specific legal obligations. Depending on the exact content of the files, the company may be required to follow notification mandates established by various state laws and federal regulations.

The public exposure of such a vast amount of data can create a dangerous foundation for subsequent criminal activities. Specifically, the leaked information could be utilized by malicious actors to conduct targeted phishing attacks or to facilitate identity theft against the organization's customers. There is a heightened risk of secondary extortion, a common tactic in modern ransomware operations where attackers leverage stolen data to pressure a victim even if the initial encryption is resolved.

In the context of modern cyber threats, ransomware groups often utilize double extortion tactics. This involves not only encrypting a company's files to disrupt operations but also stealing sensitive data to threaten its public release. This method increases the pressure on organizations to comply with ransom demands. For companies in the technology and data hosting sector, such incidents underscore the necessity of robust data security frameworks. Organizations in this sector typically focus on rigorous monitoring, strict access controls, and comprehensive incident response plans to mitigate the impact of such potential breaches. A thorough review of data security processes and the timely notification of all affected parties remains a critical step in managing the fallout of a confirmed data exfiltration event.