RansomHub claims data breach at askgs.ma

• Ransomware group: RansomHub
• Country: Morocco
• Announcement date: February 12, 2025

RansomHub claims to have compromised askgs.ma

The ransomware group known as RansomHub has officially listed the Moroccan institution askgs.ma on its leak site. In a recent announcement, the group claimed to have successfully breached the organization's systems, alleging that they were able to exfiltrate sensitive information during the operation. This announcement, posted on February 12, 2025, follows an alleged attack date of February 3, 2025.

RansomHub's public statement regarding the incident suggests that the organization's existing security measures were insufficient to prevent the intrusion. To support their claims of a successful breach, the group has reportedly shared a portion of the obtained data as proof of the compromise. This tactic is a common feature of modern ransomware operations, where attackers use public pressure to coerce victims into paying ransoms.

Details of the alleged data exfiltration

The information allegedly stolen by the attackers is extensive and covers a wide variety of sensitive categories. According to the claims made by RansomHub, the stolen datasets include a range of personal, financial, and institutional information. The group has provided screenshots as evidence, which reportedly show various types of sensitive documentation.

The specific types of data mentioned in the leak announcement include:

• Personal data
• Financial data
• Banking information
• Insurance records
• Internal documents
• Customer data
• Passport information

The presence of such diverse data types, including passport copies, insurance policies, customer lists, and bank transfer receipts, indicates a high level of sensitivity. Such a breach typically involves a process known as double extortion, where threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release if a ransom is not met. While the specific size of the data stolen and the exact ransom demand have not been disclosed by the group, the variety of documents shown suggests a significant breach of privacy.

About askgs.ma

ASKGS (Académie Supérieure de Kinesithérapie et de Génie Sanitaire) is a higher education institution located in Casablanca, Morocco. The institution is dedicated to providing specialized training and professional development programs, specifically focusing on the fields of physiotherapy and health engineering.

Analysis and potential impact

This breach poses significant risks to the organization's clients, particularly regarding the potential for identity theft and various forms of fraud due to the sensitive nature of the leaked documents. Furthermore, the exposure of such data may trigger legal processes under the data protection regulations that apply within the region where the organization operates.

The nature of the threat actor, RansomHub, is also noteworthy. RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. The group gained notoriety after reportedly absorbing various affiliates following the incident involving the ALPHV group. However, reports indicate that the group may have ceased its operations in early 2025, which suggests that this breach against askgs.ma might be among the group's final activities.

For organizations operating in the education and healthcare-related sectors, such incidents highlight the critical importance of robust cybersecurity frameworks. To defend against such threats, organizations typically focus on implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security audits. Additionally, maintaining offline, encrypted backups and implementing strict data loss prevention (DLP) measures are standard defensive steps used to mitigate the impact of unauthorized data exfiltration and ransomware deployment.