Hunters International lists HOPI on leak site claiming data exfiltration

• Ransomware group: Hunters
• Country: Czechia
• Sector: Technology
• Announcement date: April 17, 2025

Hunters International claims data theft from HOPI

The threat group known as Hunters International has listed HOPI on its leak site, claiming to have exfiltrated data from the organization. This announcement, which appeared on April 17, 2025, marks a significant development in the ongoing targeting of logistics and supply chain entities by sophisticated cybercriminal groups.

According to the claims made by the threat group, the incident occurred on April 17, 2025. Notably, the group has stated that while data was successfully exfiltrated from the organization, their systems were not encrypted during this specific operation. This approach is characteristic of modern cyber extortion tactics, where the focus shifts from disrupting availability through encryption to the theft of sensitive information to leverage against the victim.

Details of the claimed data breach

The announcement made by Hunters International provides specific metrics regarding the scale of the alleged theft, though it remains vague regarding the specific contents of the files. The group claims that a substantial volume of information has been compromised during the attack.

The specific details provided by the group include:

• Total data volume: approximately 276.7 GB
• Total file count: 750,722 files

Regarding the specific nature of the exfiltrated data, no specific details have been provided by the threat group. The available information, such as the screenshot provided by the attackers, only displays the total data volume and the total number of files involved in the breach.

About HOPI

HOPI is a logistics company operating in Central Europe. The organization provides a wide range of logistics, warehousing, and supply chain management solutions. They specialize in cold chain logistics, particularly serving the food and fast-moving consumer goods sectors.

Analysis and potential implications

Hunters International is assessed to have emerged in 2023 and is believed to be derived from Hive ransomware code. Reports indicating that the group ceased encryption activities in 2025 may suggest a shift in their operational strategy, potentially moving toward pure data exfiltration and extortion models rather than traditional ransomware encryption.

Because HOPI is based in the Czech Republic, the incident may fall under the scope of the EU General Data Protection Regulation (GDPR), potentially leading to regulatory scrutiny for the organization. Furthermore, the exposure of data could create secondary risks for employees and customers, such as identity theft or targeted phishing attacks.

In such scenarios, organizations in the logistics and supply chain sectors often face unique challenges due to the interconnected nature of their operations. When data is exfiltrated, the risks extend beyond the immediate organization to include partners and customers within the supply chain. To mitigate such risks, organizations typically focus on robust data loss prevention (DLP) measures, strict access controls, and comprehensive monitoring of data movement across the network. Implementing zero-trust architectures and ensuring rigorous patch management are also standard defensive steps used to reduce the attack surface available to groups like Hunters International.