HAL Allergy listed on RansomHouse leak site

• Ransomware group: RansomHouse
• Country: Netherlands
• Sector: Healthcare
• Announcement date: February 28, 2024

RansomHouse claims data breach at HAL Allergy

The RansomHouse ransomware group has listed the Dutch biotechnology company HAL Allergy on its leak site. According to the threat actor, the organization has been targeted in a data exfiltration attack, marking a new incident for the group, which has been active since 2021. The listing, announced on February 28, 2024, suggests a significant breach of corporate information.

The group's announcement follows a period of alleged unauthorized access to the company's network. Ransomware groups often utilize leak sites to host stolen data as a method of double extortion, where the threat actor demands payment not only to decrypt systems but also to prevent the public release of sensitive information. This strategy is designed to maximize pressure on the victim organization by threatening their reputation and legal standing.

Details of the alleged attack

The RansomHouse group claims to have successfully obtained data belonging to HAL Allergy on February 18, 2024. In their announcement, the threat actors have leveled accusations against the company's management, alleging that they attempted to conceal the network compromise from the public or relevant authorities. The group has stated their intention to publish the stolen data as a direct consequence of this perceived lack of transparency.

The incident highlights the escalating tension between ransomware operators and target organizations. When a group claims that a victim is hiding a breach, it is often a tactic used to increase the urgency of ransom negotiations. By publicly accusing a company of concealment, the attackers aim to trigger scrutiny from stakeholders, partners, and regulatory bodies, thereby increasing the likelihood of a payout.

Scope of the stolen data

The evidence provided by the RansomHouse group, including screenshots, indicates that the volume of the allegedly exfiltrated data is approximately 105 GB. While the scale of the theft is substantial, the specific nature of the files remains unclear. The group claims the stolen information consists of general corporate data.

• No specific file types or data categories were mentioned in the provided evidence.

Because the group has not specified the exact contents, it is impossible to determine whether the data includes intellectual property, financial records, or internal communications. However, the sheer volume of 105 GB suggests a broad sweep of the organization's digital environment. In many such cases, the lack of specific file descriptions is common until the group decides to release samples to prove the validity of their claims.

Organization profile: HAL Allergy

HAL Allergy is a European biotechnology company that specializes in the development, production, and distribution of allergen immunotherapies. These products are used for the treatment and prevention of various allergic diseases. The company maintains a diverse portfolio that includes both subcutaneous and sublingual products. HAL Allergy operates out of the Bio Science Park located in Leiden, Netherlands.

Potential impacts and industry risks

This incident may result in negative consequences for HAL Allergy's operational processes and its commercial reputation. Given that the company is headquartered in the Netherlands, the breach could trigger legal sanctions and audit processes under the General Data Protection Regulation (GDPR) if the stolen data is found to include personal information. Regulatory oversight in the healthcare and biotechnology sectors is typically stringent to ensure patient and corporate data integrity.

Furthermore, the RansomHouse group's focus on data exfiltration and extortion introduces the risk of secondary attacks. Stolen data is frequently repurposed for targeted phishing campaigns or used in subsequent identity theft attempts against the company's stakeholders and employees. Such secondary attacks can cause long-term damage to the trust established between a biotechnology firm and its clients.

For organizations operating in the healthcare and biotechnology sectors, this event underscores the necessity of robust defensive measures. Common industry practices to mitigate such risks include implementing strict network segmentation, maintaining comprehensive logging and monitoring to detect unauthorized access, and conducting regular audits of data access permissions. Additionally, organizations often focus on employee training to prevent initial access via phishing, which remains a primary vector for ransomware deployment.