mcdowallaffleck.com.au targeted by RansomHub in alleged data breach

• Ransomware group: RansomHub
• Country: Australia
• Sector: Professional Services
• Announcement date: August 1, 2024

RansomHub claims data exfiltration from mcdowallaffleck.com.au

The ransomware group known as RansomHub has announced on its leak site that it has successfully targeted the Australian-based organization mcdowallaffleck.com.au. According to the group's announcement, which was posted on August 1, 2024, the attackers claim to have exfiltrated a significant amount of data from the company's network. The group alleges that the breach occurred around July 24, 2024, and involves a total data volume of 470 GB.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. By publishing details about a breach, these groups aim to damage the reputation of the targeted organization and coerce them into paying a ransom. This specific incident follows a pattern of behavior observed in various ransomware campaigns where data theft is used as a primary lever for extortion.

Details of the alleged attack and extortion tactics

The RansomHub group claims that the network belonging to mcdowallaffleck.com.au was encrypted during the attack. In addition to the encryption of systems, the group asserts that confidential data was exfiltrated from the environment. The group has stated that they have already established contact with the company's directors, issuing threats to publish the stolen information if their ransom demands are not met. No specific ransom amount was mentioned in the announcement.

In a notable escalation of their tactics, the attackers have also targeted the company's cyber insurance provider, cfc.com. The group alleges that the insurance firm is failing to fulfill its obligations, and as a result, they are targeting the insurance provider as well. This approach is a characteristic example of double-extortion tactics within the ransomware ecosystem. In such scenarios, attackers do not merely encrypt a company's files to disrupt operations; they also steal sensitive data to threaten the release of that information, thereby increasing the pressure on the victim to pay.

The types of data allegedly stolen

The announcement claims that the 470 GB of stolen data is highly sensitive and contains various types of information critical to the organization's operations and stakeholders. The group claims the exfiltrated data includes:

• Project blueprints
• Tender and contract documents
• Insurance documents
• Client and partner information
• Employee personal information

About mcdowallaffleck.com.au

McDowall Affleck is an Australian-based consulting firm that specializes in providing engineering services. The company offers a range of professional solutions, including structural, civil, and construction engineering. Additionally, they provide project management support for various construction projects, making them a key player in the engineering and construction sector.

Risks and implications of the breach

The alleged exfiltration of such a large volume of data poses significant secondary risks. For employees and business partners, the theft of personal and professional information could lead to identity theft or highly targeted phishing attacks. Furthermore, because the company is based in Australia, this incident may trigger specific legal obligations under the Australian Privacy Act 1988, depending on the nature of the personal data involved.

Beyond the immediate data risks, the company may face substantial operational disruptions and long-term reputational damage. RansomHub, a group that emerged in early 2024 and reportedly ceased operations in early 2025, has a history of using these methods to target numerous organizations. For organizations in the professional services and engineering sectors, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include maintaining offline backups, implementing strict access controls, and ensuring comprehensive monitoring of network traffic to detect unauthorized data movement. Additionally, as seen in this case, the involvement of insurance providers adds a layer of complexity to the incident response and legal landscape of modern cyberattacks.