IDS Infotech listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: India
• Sector: Technology
• Announcement date: April 6, 2025

Hunters group claims data exfiltration from IDS Infotech

The threat actor known as Hunters has listed the technology organization IDS Infotech on its dedicated leak platform. According to the announcement made by the group, the attackers claim to have successfully exfiltrated a massive volume of information from the company's systems. This incident highlights the ongoing trend of cybercriminals targeting specialized service providers to gain access to large datasets.

The announcement was made on April 6, 2025, coinciding with the date the group claims the attack took place. Notably, the threat actor specified that the data was exfiltrated but was not encrypted during the incident. This distinction is significant in the context of modern cyber extortion, where the focus has shifted from locking systems to the theft of sensitive information.

Details of the claimed data breach

The claims made by the Hunters group regarding the scale of the breach are substantial. While the announcement does not provide specific details regarding the nature of the exfiltrated data, the provided documentation and screenshots indicate a massive dataset. The group asserts that the stolen information consists of a significant number of individual files across a large storage volume.

The specific metrics provided by the threat actor include:

• Total data size: 2.3 TB
• Total file count: 3,363,736 files

The lack of specific information regarding the content of the files means the exact nature of the stolen information remains unconfirmed by the announcement itself. Ransomware leak sites often use such large numbers to increase pressure on the victim during extortion negotiations.

About IDS Infotech

IDS Infotech is an India-based company that operates within the technology sector. The organization provides a variety of business process management (BPO) and software solutions. Their service portfolio is specifically tailored toward the healthcare, legal, and technology sectors. Furthermore, the company specializes in critical data handling, including medical record management and various data processing services.

Analysis and potential implications

The Hunters group is a threat actor that emerged in 2023. It is assessed to be derived from the Hive ransomware codebase. While the group has reportedly announced the cessation of its encryption activities in 2025, this incident suggests a strategic shift. The group's current approach appears to indicate a move toward an extortion model that is focused primarily on data exfiltration rather than traditional encryption-based ransomware attacks.

The exfiltration of data from an organization like IDS Infotech carries significant secondary risks. Because the company handles sensitive information for the healthcare and legal sectors, the exposure of data could lead to the compromise of employee and customer information. Such a breach can result in serious compliance issues regarding privacy standards and data protection obligations that organizations in this sector must uphold.

Furthermore, the leaked data may be utilized by malicious actors for identity theft or targeted phishing campaigns. In such scenarios, attackers use stolen information to craft highly convincing messages to deceive individuals. To defend against these types of threats, organizations typically implement robust data loss prevention (DLP) strategies, enhance monitoring of large data transfers, and enforce strict access controls to minimize the risk of unauthorized exfiltration.