Hunters International claims ransomware attack against PSI

• Ransomware group: Hunters
• Country: United States
• Sector: Professional Services
• Announcement date: February 17, 2024

Hunters International claims a ransomware attack against PSI

The ransomware group known as Hunters International has listed the organization PSI on its leak site, claiming to have successfully carried out a ransomware attack. According to the group's announcement, the threat actors have engaged in both data exfiltration and encryption activities within the organization's systems. This claim suggests a multi-stage attack designed to compromise both the availability and the confidentiality of the target's digital assets.

Details of the claimed attack

The announcement regarding the incident was published on February 17, 2024. Through this listing, the Hunters International group alleges that they have compromised the systems of PSI. The group asserts that their operations involved the unauthorized encryption of files and the theft of sensitive information from the organization's network.

While the group claims to have completed these malicious activities, the specific details regarding the nature of the breach remain limited to the group's own assertions. Ransomware attacks of this nature typically aim to disrupt an organization's ability to function by locking critical files, while simultaneously threatening to release stolen data to pressure the victim into paying a ransom. This combination of tactics is a hallmark of modern cyber extortion campaigns.

Data involved in the breach

Regarding the specific content of the leaked data, there is no detailed information provided by the threat actors concerning the exact types of information that were compromised. However, the group has provided metrics regarding the volume of the data they claim to have stolen.

• Total data size: 88 GB
• Total file count: 36,133 files

The listing does not specify the categories of data contained within these files, leaving the exact nature of the compromised information unknown at this time.

About Population Services International

Population Services International (PSI) is a global non-profit health organization. The entity works to improve the quality of life and access to healthcare services on a worldwide scale. Its primary areas of operation include reproductive health, child health, and efforts in the fight against infectious diseases.

Implications and potential risks

This claim suggests that the organization's operational continuity may have been disrupted and that sensitive corporate data could be at risk of exposure. Because PSI is an entity based in the United States, potential data breaches may lead to legal consequences under state-level privacy laws and sectoral regulations. The potential leakage of employee and customer data could lead to long-term reputational damage and increased supply chain risks.

It is assessed that Hunters International utilizes the Hive ransomware codebase. This technical detail suggests that the attacks may be conducted via double-extortion methods. In a double-extortion scenario, attackers not only encrypt the victim's data to halt operations but also steal the data to threaten its public release. This method significantly increases the risk of secondary threats, such as identity theft and targeted phishing campaigns directed at the organization's stakeholders.

For organizations operating within the professional services and global health sectors, such incidents highlight the importance of robust cybersecurity frameworks. Defensive strategies often include maintaining offline backups, implementing strict access controls, and continuous monitoring of network traffic to detect exfiltration attempts. As threat actors continue to target high-impact organizations, the risk of secondary exploitation following a breach remains a critical concern for global entities.