EUROPEANPROF targeted by RansomHub in alleged data breach

• Ransomware group: RansomHub
• Country: Spain
• Sector: Professional Services
• Announcement date: April 24, 2024

RansomHub claims to have breached EUROPEANPROF

The ransomware group known as RansomHub has announced that it has targeted the Spanish professional services firm EUROPEANPROF. According to an announcement made on the group's leak site on April 24, 2024, the threat actors claim to have successfully compromised the organization's digital infrastructure and exfiltrated sensitive information.

Ransomware attacks often involve a tactic known as double extortion, where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive files to use as leverage. By threatening to leak this information on public forums or leak sites, cybercriminals aim to pressure the victim into paying a ransom to prevent the exposure of confidential data. In this instance, the group claims the breach occurred on the same day the announcement was posted.

Details of the alleged data exfiltration

The claims made by RansomHub suggest a significant breach of the victim's internal systems. The threat actor alleges that they have gained access to the organization's servers and successfully extracted a wide array of sensitive information. The group asserts that the stolen data includes critical access credentials used for the Sage program, which is a common tool for business management and accounting. Furthermore, the attackers claim to have accessed and stolen files that were stored on the company's Dropbox account.

The announcement specifically highlights that the stolen information is not limited to technical credentials but also includes highly sensitive documents. The group states that the exfiltrated data contains confidential information and documents related to the company's customers. The specific types of data allegedly compromised include:

• Sage program access credentials
• Passwords
• Customer data

While the group has claimed to have exfiltrated data, they have not provided information regarding the total size of the data stolen or the specific number of files involved. Additionally, no information was provided regarding a ransom demand.

About EUROPEANPROF

EUROPEANPROF is a company based in Spain that operates within the professional services sector. The organization specializes in technical training and safety solutions, specifically focusing on work-at-height safety and industrial safety. They provide professional services related to safety equipment and various safety solutions designed for high-risk environments.

Impact and security considerations

This incident, as claimed by RansomHub, could have serious implications for the organization's operational continuity and the trust placed in them by their clients. The exposure of Sage program credentials and Dropbox data presents significant risks, as such information can be utilized by malicious actors to launch secondary attacks or facilitate identity theft. Because the organization is based in Spain, this incident may trigger legal sanctions and mandatory data breach notification requirements under the General Data Protection Regulation (GDPR).

RansomHub is identified as a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. The group reportedly gained momentum by absorbing affiliates from the ALPHV group. While reports suggest the group may have ceased operations in early 2025, the impact of their previous breaches remains a concern for affected entities. For organizations facing similar threats, it is a standard defensive recommendation to immediately reset all compromised passwords and conduct a comprehensive security audit of all systems to identify and remediate vulnerabilities.