Infotexim.pe targeted by RansomHub in data breach claim

• Ransomware group: RansomHub
• Country: Peru
• Sector: Technology
• Announcement date: August 7, 2024

RansomHub claims data breach at infotexim.pe

The ransomware group known as RansomHub has published a leak announcement on its dedicated leak site regarding the Peruvian technology company infotexim.pe. According to the announcement posted on August 7, 2024, the threat actors claim to have successfully breached the organization's systems. This incident follows an alleged attack date of August 6, 2024, during which the group claims to have gained unauthorized access and obtained various sensitive documents belonging to the company.

In line with the tactics often employed by modern ransomware groups, the threat actors have shared numerous file samples as part of their announcement. These samples allegedly represent the operational processes of the organization. While the group has claimed responsibility for the intrusion, no information was provided regarding the specific size of the data stolen or the total file count involved in the breach. Additionally, no information was provided regarding a ransom demand.

Alleged sensitive data includes credentials and surveillance footage

The data allegedly leaked by RansomHub is extensive and covers multiple facets of the organization's operations, ranging from administrative records to technical infrastructure details. The leaked information reportedly includes highly sensitive items that could be exploited for further malicious activities. The types of data allegedly compromised include:

• Employee identification data
• Medical records
• Tax records
• Server access credentials
• Network diagrams
• Surveillance camera footage

The inclusion of such diverse data types suggests a deep level of access into the organization's internal systems. In many ransomware scenarios, groups utilize a double extortion method, where they not only encrypt an organization's data but also threaten to leak it on public forums to increase pressure on the victim. The presence of server access credentials and network diagrams is particularly concerning, as these assets provide a roadmap and the keys necessary for subsequent unauthorized access.

Organization profile: Infotexim.pe

Infotexim is a technology and IT services company based in Peru. The organization provides a variety of specialized services to its corporate clients, including software solutions, system integration, and technical support services. As a provider of IT services, the company handles significant amounts of data related to its clients and its own internal operations.

Risk assessment and security implications

This breach presents several significant risks to the organization and its stakeholders. The exposure of employee identification data and medical records significantly increases the risk of identity theft and targeted phishing attacks against the organization's staff. Furthermore, the leaked server access credentials and network diagrams could facilitate secondary attacks against the organization's infrastructure, allowing threat actors to re-enter the network or move laterally to other systems.

From a regulatory perspective, the organization may face legal liabilities under Peruvian data protection regulations, which could potentially lead to administrative sanctions. It is also worth noting the timeline of the threat actor; RansomHub is reported to have emerged in early 2024 and ceased operations by early 2025. Because of this, the misuse of the leaked data by various other actors may be observed in the future.

To mitigate the impact of such a breach, it is recommended that the organization conduct a comprehensive forensic investigation to determine the exact scope of the leaked data. For organizations in the technology sector, maintaining robust security measures is vital. Common defensive steps include implementing multi-factor authentication, maintaining strict network segmentation to prevent lateral movement, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.