Facilcreditos.co targeted by RansomHub in alleged data breach

• Ransomware group: RansomHub
• Country: Colombia
• Sector: Financial Services
• Announcement date: November 27, 2024

RansomHub claims responsibility for facilcreditos.co data leak

The ransomware group known as RansomHub has published an announcement on its dedicated leak site claiming to have obtained data belonging to facilcreditos.co. In a post dated November 27, 2024, the threat actor group alleged that they successfully breached the organization's systems, resulting in the exfiltration of confidential information. To support their claims, the group has provided sample files via public links to demonstrate the nature of the stolen data.

RansomHub is recognized as a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. The group reportedly gained significant momentum and attracted various affiliates following the high-profile incident involving the ALPHV group. While the group was highly active during its emergence, reports indicate that its operations were said to have ceased in early 2025.

Details of the alleged breach and stolen information

According to the claims made by RansomHub, the threat actors managed to gain unauthorized access to the local networks of facilcreditos.co. This access allowed them to bypass security measures and obtain various datasets maintained by the institution. The group's announcement suggests a targeted operation aimed at extracting sensitive corporate and client-side information.

The samples shared by the attackers indicate that the stolen information is highly sensitive and pertains directly to the institution's customer base. The data reportedly includes a variety of personal and financial documents, such as:

• Customer identification data
• Credit application forms
• Contact information
• Financial data

Specifically, the shared samples are said to contain personal identification details, addresses, phone numbers, and income information. Furthermore, the leaked files are alleged to include commercial contracts belonging to the institution's customers, highlighting the breadth of the potential exposure.

About facilcreditos.co

Facilcreditos is a financial services organization based in Colombia. The company provides a range of credit and financial solution services specifically designed for individual users, making the sensitive nature of the allegedly stolen data particularly significant for its client base.

Risk assessment and industry implications

The alleged leak of such extensive personal and financial information poses a high risk to the customers of the institution. The nature of the data—including identification, contact details, and income information—creates a significant opportunity for identity theft and various forms of fraud. Because the organization operates within the financial services sector, there is a heightened risk that the leaked data could be utilized by malicious actors to conduct highly targeted phishing attacks against the affected individuals.

From a regulatory perspective, under Colombian data protection regulations, the institution may be required to report this incident to the relevant authorities and may be obligated to notify the individuals whose data has been compromised. The situation underscores the importance of robust data protection measures for financial entities.

The tactics employed by RansomHub in this instance appear to align with a double-extortion strategy. In such scenarios, threat actors do not merely encrypt data to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to publish this data on public leak sites, the group aims to inflict maximum damage on the corporate reputation of the victim organization. To defend against such threats, organizations in the financial sector typically focus on strengthening network segmentation, implementing strict access controls, and maintaining comprehensive monitoring to detect unauthorized lateral movement within local networks.