GPF Lewis listed on Hunters International leak site

• Ransomware group: Hunters
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: May 5, 2025

The ransomware group known as Hunters International has listed the London-based professional services firm GPF Lewis on its leak site. The group claims to have successfully targeted the organization, alleging that they have both exfiltrated sensitive information and encrypted the company's systems.

Details of the alleged attack

According to the announcement made on May 5, 2025, the Hunters International group asserts that they have conducted a successful breach against GPF Lewis. The group's claims suggest a dual-pronged attack strategy involving both data theft and system encryption. In modern cyberattack landscapes, this often refers to a double extortion tactic, where threat actors not only lock the victim out of their own systems but also threaten to release stolen data to pressure the organization into paying a ransom.

The group claims that the attack occurred on the same day the announcement was posted, May 5, 2025. While the group has published the organization's name on their platform, they have not issued a specific ransom demand in their public listing. This type of activity is common among ransomware groups that utilize leak sites to shame victims and increase pressure through public exposure.

Scope of the claimed data theft

The scale of the data breach, as claimed by the attackers, is significant. Hunters International asserts that they have obtained a massive dataset from the organization. The specifics of the claimed theft include the following:

• Total data size: 1.1 TB
• Total file count: 962,594 files

Regarding the specific nature of the stolen information, the group has not provided any details. The available information from the leak site is limited to the total volume and the number of files involved. Consequently, there is no information available regarding the specific types of documents or the exact content of the exfiltrated data.

About GPF Lewis

GPF Lewis is a professional services firm based in London, United Kingdom. The company specializes in the construction and property consultancy sector. Their service offerings include critical project functions such as cost management, project management, and building surveying for various construction projects. Given the nature of their business, the firm handles significant professional data related to large-scale construction and property developments.

Risk assessment and implications

This incident may pose a significant risk of exposure for both corporate and client data held by GPF Lewis. Because the organization is based in the United Kingdom, the reported breach may necessitate formal notification to data protection authorities in accordance with the UK GDPR. The potential consequences of such a leak extend beyond the immediate technical disruption caused by system encryption.

Depending on the actual nature of the leaked data, secondary risks could emerge, such as identity theft or targeted phishing attacks directed at the organization's employees and clients. Furthermore, the reported encryption of systems suggests that the organization's operational continuity could be adversely affected. In such scenarios, organizations often face the challenge of restoring services while managing the reputational and legal fallout of the exposure.

It is worth noting that there have been reports suggesting that Hunters International ceased its encryption activities in 2025. If these reports are accurate, it can be inferred that the group's recent activities, such as this listing, may be part of a strategic shift focused primarily on data extortion rather than the traditional ransomware model of system locking. This shift highlights the evolving nature of cyber threats, where the focus moves from operational disruption to the exploitation of sensitive information for leverage.

General defensive considerations

For organizations operating in the professional services sector, maintaining robust security postures is essential to mitigate these risks. Common defensive measures include implementing strict access controls, maintaining offline backups, and conducting regular security awareness training to prevent initial entry via phishing. Additionally, monitoring for large-scale data transfers can help detect exfiltration attempts before they reach a critical scale.