Hunters International claims data breach and encryption at HOYA Corporation

• Ransomware group: Hunters
• Country: Japan
• Sector: Healthcare
• Announcement date: July 16, 2024

The Hunters International ransomware group has officially listed the Japanese multinational technology company HOYA Corporation on its leak site. According to the claims made by the threat actor, the organization has fallen victim to a cyberattack involving both data exfiltration and system encryption.

Details of the claimed attack

The announcement regarding the incident was published on July 16, 2024. In the post, the Hunters International group asserts that they have successfully exfiltrated sensitive data belonging to the organization. Furthermore, the group claims that the company's systems have been encrypted, a hallmark of ransomware operations designed to disrupt business continuity.

Ransomware attacks of this nature often follow a double extortion model. In such scenarios, attackers do not merely lock the victim's systems to demand a ransom for decryption; they also steal sensitive information to use as leverage. By threatening to leak the stolen data on public or private leak sites, the attackers aim to increase the pressure on the victim to pay the ransom, leveraging the threat of reputational damage and regulatory scrutiny.

Data involved in the leak

While the specific volume of the stolen data and the exact number of files involved have not been disclosed by the group, the leak site has provided evidence of the breach. Screenshots shared by the attackers indicate that various documents have been compromised. Specifically, the leaked samples appear to include sensitive corporate documentation.

The data identified in the leak includes:

• Contracts
• Agreements

The exposure of such documents can lead to significant operational and legal complications for a multinational entity.

About HOYA Corporation

HOYA Corporation is a Japanese multinational technology company that manufactures optical glass, photonic products, medical devices, and eyeglass lenses. The company operates globally within the healthcare and information technology sectors.

Impact and potential risks

The claims made by the Hunters International group could lead to significant disruptions in the organization's operational processes. The leakage of internal contracts and agreements creates several critical risks, such as the exposure of trade secrets and the potential loss of competitive advantage in the global market.

From a regulatory perspective, the organization may face legal obligations under Japan's data protection regulations following the exposure of this information. Additionally, if the stolen data is published publicly, it may trigger secondary risks, such as identity theft or the execution of targeted phishing attacks against the organization's third parties and partners.

Given the historical activities of the Hunters International group, this breach could negatively impact the organization's reputation. To mitigate such risks, organizations in the healthcare and technology sectors often implement defensive measures such as robust encryption for data at rest and in transit, strict access controls, and comprehensive monitoring to detect unauthorized data movement. Maintaining a rigorous incident response plan and ensuring regular backups are also essential components of a modern cybersecurity posture to defend against the evolving tactics of ransomware groups.