Intersport listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: France
• Sector: Professional Services
• Announcement date: April 3, 2024

Hunters ransomware group claims data exfiltration from Intersport

The Hunters ransomware group has officially listed the French organization Intersport on its dedicated leak site. According to an announcement made by the threat actors on April 3, 2024, the group claims to have successfully gained unauthorized access to the organization's internal systems and subsequently exfiltrated a significant volume of data.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption process begins. The threat actors then use the stolen data as leverage, threatening to publish it on public leak sites if their demands are not met. This method places immense pressure on organizations due to the potential for regulatory scrutiny and loss of customer trust.

Details of the alleged data breach

The announcement made by the Hunters group on April 3, 2024, provides specific details regarding the scale of the alleged theft. The group claims to have compromised a dataset totaling 52.2 GB in size. This dataset is reported to consist of 25,934 individual files. While the group has not specified a ransom demand, the publication of these details on a leak site serves as a public demonstration of the breach.

Based on the information provided by the attackers, the compromised data includes various sensitive categories. The leaked information reportedly contains:

• Passport data
• Corporate data

Visual evidence provided by the group, such as screenshots, allegedly displays examples of these documents, specifically showing passports and general corporate information. The presence of such sensitive personal identification information (PII) significantly elevates the severity of the incident.

About Intersport

Intersport is an international retail chain specializing in the sale of sports equipment, gear, and apparel. Its French operations serve sports enthusiasts through an extensive network of stores and an e-commerce platform. As a major player in the retail sector, the organization manages a vast amount of customer and corporate information to facilitate its wide-reaching operations.

Analysis and potential implications

The alleged exfiltration of passport data carries heavy implications for the individuals whose information was taken. The exposure of such highly sensitive documents may increase the risk of identity theft for the affected individuals. Furthermore, because the organization is based in France, this incident may trigger mandatory data breach notification obligations under the General Data Protection Regulation (GDPR), which governs how personal data must be protected and reported within the European Union.

Technical observations suggest that the Hunters group may be utilizing the Hive codebase. The use of established or sophisticated codebases can indicate that the attack methods employed by the group are highly sophisticated, making detection and prevention more challenging for standard security measures.

The publication of this data can lead to significant reputational damage and create trust issues among the organization's customers. Beyond the immediate impact, secondary risks include the potential use of the leaked data in targeted phishing campaigns, where attackers use stolen information to craft highly convincing fraudulent communications to further exploit victims.

For organizations operating in the retail and professional services sectors, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication (MFA) across all systems, maintaining rigorous patch management schedules to close vulnerabilities, and conducting regular employee training to recognize phishing attempts. Additionally, organizations often employ advanced monitoring tools to detect unusual data movement that might indicate exfiltration in progress.