Linkc claims data breach against h2o.ai

• Ransomware group: Linkc
• Country: United States
• Sector: Technology
• Announcement date: February 19, 2025

The threat group known as Linkc has published data allegedly belonging to h2o.ai on their leak site. According to the announcement made on February 19, 2025, the group claims to have successfully conducted an operation against the systems of the technology firm.

The alleged attack event

The Linkc group claims to have conducted an operation against h2o.ai systems on January 29, 2025. Through this alleged intrusion, the group asserts that they have obtained sensitive files that include AI training datasets, source code, and internal correspondence. Following the claimed operation, the group has published the relevant data on their dedicated leak site.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to release stolen information to the public to increase pressure for ransom payments. This tactic aims to maximize the impact of the breach by targeting the victim's reputation and legal standing. While the specific details regarding the ransom demand or the total size of the data exfiltrated remain unknown, the publication of the data itself serves as a primary method of coercion.

The data allegedly involved in the leak

The information that the group claims to have exfiltrated is extensive and covers various aspects of the organization's operations. The alleged data includes several sensitive categories that could impact both the company and its clients. The specific items listed by the group include:

• Non-anonymized customer datasets
• Source code from Git repositories
• Contracts
• Customer personal data
• Project documentation
• Employee email backups

The inclusion of non-anonymized datasets and personal data is particularly significant in modern cyberattacks, as it directly exposes individuals to potential secondary risks. When sensitive information is leaked, it can lead to downstream consequences such as identity theft or highly targeted phishing attacks directed at the individuals whose data was compromised.

About h2o.ai

H2O.ai is a technology company that develops open-source artificial intelligence and machine learning platforms. It provides software solutions for building and deploying enterprise-grade AI models.

Analysis and potential implications

This alleged leak may pose significant risks to the organization's intellectual property and customer privacy. The exposure of source code for AI models could potentially weaken the organization's competitive advantage and create a foundation for further attacks. Because the leaked material includes code from Git repositories, the integrity of their development environment may be under scrutiny.

As the organization is based in the United States, the incident may need to be evaluated within the framework of state-level data protection laws and potential legal obligations. The disclosure of customer data could trigger secondary risks such as identity theft and targeted phishing attacks. Furthermore, the exposure of project costs and contracts can provide adversaries with valuable business intelligence.

For organizations operating in the technology and artificial intelligence sectors, such incidents highlight the importance of robust defensive measures. Common defensive steps often include implementing strict access controls for Git repositories, utilizing encryption for sensitive datasets, and maintaining comprehensive monitoring of internal correspondence systems. Protecting intellectual property and customer data is essential for maintaining competitive standing and legal compliance in a highly regulated landscape. At this time, public information about the Linkc group remains limited.