Hunters International claims to have stolen data from ENEA Italy

• Ransomware group: Hunters
• Country: Italy
• Sector: Energy & Utilities
• Announcement date: August 2, 2024

The Hunters International ransomware group has listed ENEA Italy on its dedicated leak site. According to the announcement made by the threat actor, the group claims to have exfiltrated a significant volume of data belonging to the Italian organization.

Details of the alleged attack

The announcement regarding the alleged breach was posted on the Hunters International leak site on August 2, 2024. While the group's post was made on that date, the group claims the actual attack took place on August 1, 2024. In a notable detail of the claim, the group stated that while data was exfiltrated from the organization, their systems were not encrypted during the incident.

Ransomware groups often employ a tactic known as double extortion. In these scenarios, attackers do not merely lock a victim's systems to demand a ransom for decryption; they also steal sensitive information. The threat of leaking this stolen data on a public site serves as additional leverage to pressure the organization into paying the ransom. This method shifts the focus from operational disruption to the potential exposure of sensitive institutional or personal information.

Data involved in the claim

The Hunters International group has provided specific metrics regarding the volume of the alleged theft, though they have not provided granular details regarding the specific types of files or the nature of the information contained within them. The listing includes the following claims regarding the stolen data:

• Total data size: approximately 219.9 GB
• Total file count: 236,372 files

The group has not provided any specific details regarding the nature of the allegedly exfiltrated data. The information available in the announcement is limited to the total volume and the file count, as seen in the provided screenshots.

About ENEA Italy

ENEA is Italy's national research agency for energy, the environment, and new technologies. It is a public-funded organization focused on sustainable development and energy efficiency.

Potential implications and risks

The claims made by the Hunters International group may pose risks to the institution's operational continuity and data privacy. Because ENEA is an Italy-based entity, the confirmation of such a breach could lead to legal proceedings and administrative sanctions under the General Data Protection Regulation (GDPR). Depending on the actual content of the leaked data, secondary risks such as identity theft or targeted phishing attacks against employees and business partners may emerge.

The group's alleged connection to the Hive ransomware suggests that their attack methods could be sophisticated. Furthermore, given the institution's position in the energy sector, it is possible that the breach could have negative implications for supply chain security. Attacks on critical infrastructure or research institutions in the energy sector can create ripple effects across the broader industrial landscape.

To mitigate such risks, organizations in the energy and research sectors often implement defensive measures such as robust network segmentation, multi-factor authentication, and continuous monitoring of data egress to detect unauthorized exfiltration. Maintaining a strong incident response plan is also essential for managing the legal and operational consequences of a potential data leak.