Pharma Force listed on Hunters International leak site

• Ransomware group: Hunters
• Country: Belgium
• Sector: Healthcare
• Announcement date: April 21, 2025

Hunters International claims data exfiltration against Pharma Force

The threat actor known as Hunters International has listed the Belgian healthcare and pharmaceutical services provider, Pharma Force, on its dedicated leak site. According to the announcement made on April 21, 2025, the group claims to have successfully exfiltrated data belonging to the organization. This incident follows a pattern often seen in modern cyberattacks, where threat actors prioritize the theft of sensitive information over the encryption of local systems.

In this specific instance, the announcement states that the organization's data was not encrypted during the attack. Instead, the group alleges that the primary objective was the successful exfiltration of information from the company's environment. This approach is a hallmark of double extortion tactics, where attackers threaten to release stolen data to pressure victims into paying a ransom, even if the company's operational systems remain functional.

Details of the alleged data breach

While the group has published a listing for Pharma Force, the announcement lacks detailed information regarding the specific content or the exact nature of the allegedly leaked data. There is no information provided concerning the specific types of files or the categories of data that were targeted during the intrusion.

Despite the lack of detail regarding the content, the group has provided specific metrics regarding the volume of the stolen information. The claim includes the following details:

• Total data size: 645.7 GB
• Total file count: 281,342 files

The scale of this alleged theft suggests a significant breach of the organization's digital infrastructure, involving a vast number of individual files.

About Pharma Force

Pharma Force is a healthcare and pharmaceutical services provider based in Belgium. The company operates within the healthcare sector, offering pharmaceutical supply and logistics solutions designed to support the needs of the healthcare industry.

Potential risks and industry implications

The alleged leak poses several significant risks to the organization's operational processes. Because the data is associated with the healthcare sector, the incident could lead to complex compliance issues and administrative sanctions under the General Data Protection Regulation (GDPR). The sensitive nature of healthcare-related information often means that breaches can have long-lasting consequences for both the provider and the individuals involved.

Beyond regulatory concerns, secondary risks may emerge for the organization's employees and customers. These risks include the potential for identity theft or the execution of targeted phishing attacks. When attackers possess large volumes of data, they can craft highly convincing social engineering campaigns to further exploit the victims.

The assessment of this group suggests that Hunters International may use the Hive codebase, which indicates that their operations are heavily focused on data exfiltration. The ultimate impact of this incident on Pharma Force will depend heavily on the specific nature and sensitivity of the leaked data. For organizations in the healthcare and logistics sectors, maintaining robust defensive measures—such as strict access controls, continuous monitoring, and comprehensive data encryption—is essential to mitigate the impact of such exfiltration-focused attacks.