ralord ransomware group lists ihara.com.br on its leak site

• Ransomware group: ralord
• Country: Brazil
• Sector: Agriculture and Food Production
• Announcement date: March 27, 2025

Brazilian agricultural manufacturer ihara.com.br targeted by ralord

The threat actor known as ralord has listed the Brazilian company ihara.com.br on its leak site. This announcement, published on March 27, 2025, follows an alleged compromise of the organization's data. While the group's identity and specific operational details remain limited in the public domain, the listing marks a significant development for the targeted entity.

Details of the alleged data breach

According to the claims made by the ralord group, the attackers have obtained a substantial amount of information from the organization. The threat actor alleges that they have compromised a total of 1 TB of data. Currently, the group is presenting 70 GB of this data on its leak site. The announcement includes various details regarding the operations of the company, though no specific ransom demand has been disclosed by the group.

The data allegedly exfiltrated by the attackers is said to consist of several sensitive categories. The information identified in the listing includes:

• Secret reports
• Private plans
• Credentials
• Project source codes
• Various documents
• PDF files
• Payment records
• Desktop hashes

About ihara.com.br

IHARA is a Brazilian company that was established in 1965. The organization specializes in the development and manufacturing of agricultural chemical products that are specifically aimed at crop protection.

Analysis and potential impact

This alleged leak may pose significant risks to the organization's intellectual property and trade secrets. The exposure of sensitive documents, such as project source codes, could weaken the company's competitive advantage and compromise its supply chain security. Furthermore, the disclosure of payment records and credentials could lead to identity theft or targeted phishing attacks against employees and business partners.

From a regulatory perspective, the organization may face legal sanctions under Brazil's LGPD regarding the protection of personal data. The nature of the data release, where the threat actor has chosen to release the data partially, suggests that the group may resort to double extortion tactics in the future. In such scenarios, attackers typically steal data before encrypting systems, using the threat of leaking the information to pressure the victim into paying a ransom.

To defend against such threats, organizations in the agriculture and food production sector can implement various defensive measures. These include maintaining robust backup solutions, implementing multi-factor authentication to protect credentials, and conducting regular security awareness training to mitigate phishing risks. Additionally, monitoring for unauthorized data exfiltration and ensuring strict access controls for intellectual property, such as source codes and private plans, are essential components of a modern cybersecurity posture.