Hunters claims data breach against CCOO Servicios

• Ransomware group: Hunters
• Country: Spain
• Sector: Professional Services
• Announcement date: February 22, 2025

Hunters claims data breach against CCOO Servicios

The ransomware group known as Hunters has published an announcement on its leak site claiming responsibility for a cyberattack targeting CCOO Servicios. According to the group's post, which appeared on February 22, 2025, the organization has been victimized in a significant data breach and encryption event.

Details of the alleged attack

The claims made by the Hunters group suggest a multi-stage attack involving both data exfiltration and infrastructure disruption. The group alleges that they successfully carried out encryption activities on the organization's infrastructure, a tactic commonly used in ransomware attacks to disrupt operational continuity. By encrypting files, attackers aim to lock the victim out of their own systems, creating pressure to meet ransom demands.

In addition to the encryption claims, the group asserts that they have successfully exfiltrated a massive volume of data from the organization's systems. While the group's announcement was made on February 22, 2025, the exact timing of the initial intrusion remains unconfirmed by the source. Such attacks often follow a pattern where attackers gain access, move laterally through the network, and then extract sensitive information before deploying ransomware to mask their tracks or increase leverage.

Data involved in the leak

The Hunters group has provided specific metrics regarding the scale of the alleged data theft. While the provided screenshots do not provide specific details regarding the nature of the data, they indicate the following volume of information has been targeted:

• Total data size: 570.8 GB
• Total file count: 689,764 files

The listing does not specify the exact file types or the specific categories of information contained within these files.

About CCOO Servicios

CCOO (Comisiones Obreras) is one of the largest trade union confederations in Spain. It operates to defend workers' rights, improve working conditions, and negotiate collective bargaining agreements. As a significant entity within the professional services sector in Spain, the organization plays a vital role in the country's labor landscape.

Impact and organizational implications

The claims made by the Hunters group suggest that the organization's operational continuity could be disrupted and data privacy may have been compromised. For an organization operating in Spain, legal sanctions and notification obligations under GDPR might arise. Depending on the content of the allegedly exfiltrated data, the exposure of employee or customer information could trigger secondary risks such as identity theft.

This incident may also reflect evolving trends in the threat landscape. Given the reports that the group ceased encryption activities in 2025, this incident may be related to the group's evolving strategies. Modern ransomware groups often shift between pure data extortion—where they focus solely on stealing data to leak it—and traditional ransomware, which includes the encryption of systems.

For organizations in the professional services sector, such incidents highlight the necessity of robust defensive measures. Common defensive steps include maintaining offline backups, implementing strict access controls, and ensuring continuous monitoring of network traffic to detect unauthorized data exfiltration. Furthermore, maintaining a comprehensive incident response plan is essential for managing the legal and operational fallout that follows a confirmed breach.