International Busines Service targeted by crypto24 ransomware group

• Ransomware group: crypto24
• Country: Egypt
• Sector: Professional Services
• Announcement date: April 8, 2025

The threat actor known as crypto24 has listed International Busines Service on its leak site, alleging that the company's data has been compromised. According to the announcement made on April 8, 2025, the group claims to have obtained various documents related to the company's operational processes. Information regarding this specific group remains limited in the public domain.

The alleged data breach event

The listing on the crypto24 leak site suggests a significant breach of operational data. While the group has posted an announcement regarding the compromise, it is important to note that the details provided by the threat actor are claims made by the group itself. In many modern ransomware scenarios, threat actors utilize a tactic known as double extortion. This method involves not only encrypting an organization's local files to disrupt operations but also exfiltrating sensitive data to use as leverage. By threatening to publish this information on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of their proprietary or personal information.

In this specific instance, the group has posted an announcement of a data leak, but they have not provided any screenshots to verify the authenticity of the stolen files. Furthermore, no specific information was provided regarding the total size of the data stolen or the specific number of files involved. The group has also not issued a ransom demand in the available announcement.

Claimed sensitive information

The post claims to contain a variety of sensitive documents that could impact individuals and the organization. The specific types of data mentioned in the claim include:

• Identity documents (front and back, in image and PDF formats) of approximately 3,000 people
• HR reports
• Payroll documents

The target organization

The organization identified in the leak is International Busines Service, which is located in Egypt. The company operates within the professional services sector.

Impact and security implications

The nature of the allegedly leaked data may pose a significant risk of identity theft for the company's employees and clients. The exposure of HR and payroll documents could lead to a breach of internal confidentiality and expose staff to targeted phishing attacks. When personal identifiers such as identity cards are compromised, the risk of social engineering increases, as attackers can use the stolen information to pose as legitimate entities.

Furthermore, the publication of such data could negatively impact the company's reputation and potentially weaken its supply chain security. Organizations in the professional services sector often handle sensitive client information, making them a high-value target for cybercriminals. The exposure of internal documents can erode the trust that clients place in a service provider.

From a regulatory perspective, the company may face legal scrutiny under Egyptian data protection regulations due to the potential exposure of personal information. When such breaches occur, organizations typically must follow specific protocols to mitigate damage, such as notifying affected individuals and implementing enhanced monitoring of their networks to detect further unauthorized access.

To defend against such threats, organizations generally focus on robust access controls, multi-factor authentication, and regular security awareness training for employees to recognize phishing attempts. Maintaining strict data encryption standards for both data at rest and data in transit is also a fundamental defensive step in protecting sensitive HR and payroll information from unauthorized exfiltration.