Hunters International claims to have leaked data from ICBC London

• Ransomware group: Hunters
• Country: United Kingdom
• Sector: Financial Services
• Announcement date: September 11, 2024

The threat actor known as Hunters International has listed ICBC London on its leak site, claiming to have successfully exfiltrated a massive volume of sensitive information from the financial institution. The announcement, made on September 11, 2024, suggests a significant data breach involving a vast amount of organizational and client-related files.

The details of the alleged attack

According to the claims made by the Hunters International group, the organization was targeted on September 11, 2024. The group alleges that it has exfiltrated a total of 6.6 TB of data from ICBC London. This massive dataset is reported to consist of 5,210,357 individual files. Notably, the announcement indicates that the data was exfiltrated from the organization's systems, but the group has not indicated that the data was encrypted during the process.

In the evolving landscape of cybercrime, ransomware groups often employ a strategy known as double extortion. In such scenarios, attackers do not merely encrypt a victim's files to demand a ransom for the decryption key; they also steal sensitive data and threaten to leak it on public platforms if their demands are not met. This tactic increases the pressure on organizations, as the threat of public exposure can cause significant reputational and regulatory damage, even if the organization has robust backup and recovery procedures in place to handle encrypted systems.

The scope of the alleged data leak

The leaked data, as described by the threat actor through provided screenshots, appears to contain highly sensitive information belonging to the organization's clients. The exposure of such data poses a direct threat to the privacy and security of the individuals involved. The specific types of data identified in the claim include:

• Client KYC (Know Your Customer) documents
• Bank statements

The presence of KYC documents is particularly concerning, as these files often contain identity verification details such as government-issued IDs, addresses, and other personal identifiers used to prevent financial crime. When combined with bank statements, which reveal detailed financial histories and transaction patterns, the risk to the affected individuals is significantly heightened.

About ICBC London

ICBC London serves as the London branch of the Industrial and Commercial Bank of China (ICBC). It operates as a global financial institution, providing a wide range of essential services including corporate banking, trade finance, and treasury services. Given its role in the global financial infrastructure, the security of its data is paramount to maintaining trust in international banking operations.

Potential risks and industry implications

The claims made by Hunters International could lead to severe consequences for both the organization and its clients. For the clients, the exposure of KYC documents and bank statements creates a high risk of identity theft and various forms of financial fraud. For the organization, the breach could trigger administrative and legal proceedings under United Kingdom data protection regulations and the UK GDPR, due to the sensitive financial nature of the leaked information. Furthermore, such an incident can result in lasting reputational damage and leave the institution vulnerable to highly targeted phishing attacks designed to exploit the stolen information.

From a technical perspective, the group's reported use of the Hive codebase suggests that their operational methods may follow a trajectory similar to previous iterations of that malware. It is also noteworthy that the group reportedly ceased encryption activities in 2025, which may indicate a strategic shift toward a model focused primarily on data exfiltration and subsequent leaks rather than traditional ransomware encryption.

To defend against such threats, organizations in the financial sector typically implement multi-layered security strategies. These include robust identity and access management (IAM) to limit data access, comprehensive encryption for data at rest and in transit, and continuous monitoring to detect unauthorized data movement. Additionally, organizations often conduct regular audits and implement strict data loss prevention (DLP) protocols to mitigate the risk of large-scale exfiltration.