Omni United listed on hunters ransomware leak site

• Ransomware group: hunters
• Country: Singapore
• Sector: Manufacturing
• Announcement date: February 26, 2025

The threat actor group known as hunters has claimed responsibility for a cyberattack targeting Omni United. According to a listing on the group's leak site, the organization's data has been both exfiltrated and encrypted by the attackers.

Details of the alleged attack

The hunters group officially listed Omni United on their dedicated leak site on February 26, 2025. While the announcement was made in late February, the threat actor alleges that the actual attack activity took place much earlier, specifically on February 4, 2025. This timeline suggests a period of unauthorized access and activity prior to the public disclosure on the leak site.

In modern ransomware campaigns, threat actors often employ a method known as double extortion. This tactic involves two distinct stages: first, the attackers gain access to a network to encrypt critical files, disrupting business operations; second, they exfiltrate sensitive information to use as leverage. By threatening to release stolen data on a public leak site, the group increases the pressure on the victim to pay the ransom, as the threat of a data leak can cause significant reputational and legal damage even if the company can restore its systems from backups.

Data involved in the breach

The claims made by the hunters group suggest that the breach involves sensitive information. Based on screenshots provided by the attackers, the leaked data appears to include various forms of personal information. Specifically, the following types of data are identified as being affected:

• Identity documents
• Signature samples

The presence of such sensitive documentation, such as identification cards and signature samples, significantly increases the potential impact of the breach. When personal identifiers are compromised, it often leads to heightened risks for the individuals involved, as this information is highly valuable for fraudulent activities.

Organization profile

Omni United is a global tire company specializing in the design, development, and distribution of tires for passenger cars, light trucks, and specialty vehicles. The company operates globally with brands such as Radar Tires.

Impact assessment and industry implications

The claims made by the hunters group could have serious consequences for Omni United. The alleged exfiltration of personal data may facilitate identity theft or targeted phishing attacks against the organization's stakeholders. Furthermore, the encryption of data poses a direct threat to the operational continuity of the company. Given that Omni United is based in Singapore, these events could trigger legal processes under the Personal Data Protection Act (PDPA).

The hunters group is assessed to have ties to the Hive ransomware, a factor that may increase the risk of secondary extortion. In such scenarios, attackers may attempt to contact different stakeholders or use the stolen information to demand multiple payments.

For organizations within the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. To defend against these threats, companies typically implement multi-factor authentication, maintain offline backups, and conduct regular security awareness training to prevent phishing. Additionally, maintaining strict compliance with regional data protection regulations is essential for managing the legal risks associated with potential data breaches. As seen in this case, the loss of sensitive identity documents can create long-term risks for both the organization and its customers.