Finlay Screening & Crushing Systems listed by Hunters ransomware group

• Ransomware group: Hunters
• Country: Australia
• Sector: Manufacturing
• Announcement date: February 20, 2024

Hunters ransomware group claims attack on Finlay Screening & Crushing Systems

The Hunters ransomware group has listed the Australia-based company Finlay Screening & Crushing Systems on its dedicated leak site. According to the group's announcement, the organization has been targeted in a cyberattack involving both data exfiltration and encryption.

Details of the claimed attack

On February 20, 2024, the Hunters International group claimed that data belonging to Finlay Screening & Crushing Systems was exfiltrated and encrypted. The group announced this situation by listing the company on its leak platform. These claims are considered part of the group's operational activities. The group's past activities indicate that they have adopted a double-extortion strategy, a method where attackers not only encrypt an organization's files to disrupt operations but also steal sensitive information to threaten its public release.

Data involvement and specifics

Regarding the specifics of the incident, no information has been shared regarding the content of the allegedly exfiltrated data. The group has only stated that the data was exfiltrated and encrypted. The listing names no specific data types.

The organization profile

Finlay Screening & Crushing Systems is an Australian-based company that supplies screening and crushing equipment for the mining, quarrying, and recycling industries. The company specializes in the sales, rental, and technical support services of heavy machinery.

Analysis and potential risks

Hunters International is a group that began operations in 2023 and is assessed to be derived from the Hive ransomware codebase; it reportedly announced the cessation of its encryption activities in 2025. The exfiltration of the company's data may lead to secondary risks such as the exposure of employee and customer information. Furthermore, the risk of the leaked data being used for identity theft or targeted phishing attacks should be considered.

The company may face legal obligations under Australian data protection regulations following such an incident. In general, when a company faces a double-extortion ransomware attack, the risks extend beyond immediate operational downtime. The threat of leaking sensitive information creates a long-term liability involving regulatory compliance and reputational damage. Organizations in the manufacturing and heavy machinery sectors often manage complex supply chains and sensitive client data, making them targets for such sophisticated threats.

To defend against such threats, organizations typically focus on robust backup strategies, network segmentation, and continuous monitoring. Implementing multi-factor authentication and conducting regular security awareness training are also standard defensive measures to mitigate the risk of initial access and subsequent lateral movement by threat actors.