RansomHub claims data leak of www.constelacion.com.sv

• Ransomware group: RansomHub
• Country: El Salvador
• Sector: Technology
• Announcement date: June 4, 2024

RansomHub claims to have leaked data from www.constelacion.com.sv

The ransomware group known as RansomHub has announced on its leak site that it has published a significant amount of data allegedly belonging to the organization www.constelacion.com.sv. According to the claims made by the threat actor, the leaked dataset consists of approximately 470 GB of information. This announcement was officially listed on the group's leak platform on June 4, 2024.

Details of the alleged attack

The threat actor, RansomHub, claims that the decision to publish the stolen data was made after negotiations with the institution failed. In their announcement, the group alleges that the organization's backup systems were insufficient to prevent or recover from the incident. Furthermore, the group asserts that they have gained access to internal communications and operational data, a claim they support by presenting shared sample files as evidence of their access.

The group claims the attack occurred on April 2, 2024, though the data was not listed on their leak site until June 4, 2024. While the group has made these claims regarding the failure of the institution's defenses and the outcome of negotiations, no specific ransom demand has been disclosed in the available information.

Data types allegedly involved

Based on the file lists presented in the screenshots provided by the group, the stolen data is said to include a variety of sensitive information. The leaked content reportedly encompasses:

• Internal communications
• Operational reports
• Invoices
• Identity documents (DUI)
• Customer transaction data

Impact and security implications

The potential exposure of this data carries significant risks for both the organization and its clients. For the customers of the institution, the leak may increase the risk of identity theft and fraudulent activities. Given the nature of the institution's financial operations, the leaked data could potentially lead to disruptions in regulatory compliance processes. There is also a possibility that the institution and its customers could be exposed to targeted phishing attacks resulting from the breach.

The incident may result in reputational damage and potential legal proceedings for the institution. It is worth noting that RansomHub has been observed working with former ALPHV affiliates, and the group is considered likely to continue employing double-extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data but also steal it, threatening to leak the sensitive information on public forums if the ransom is not paid.

Defensive considerations for technology organizations

In the wake of such claims, organizations in the technology and financial sectors often face complex recovery and compliance challenges. To mitigate the risks associated with ransomware and data exfiltration, industry best practices generally suggest several defensive layers. Strengthening backup protocols is a primary defense; ensuring that backups are immutable and stored offline can prevent attackers from deleting them during an incident.

Furthermore, implementing strict access controls and monitoring internal communications can help detect unauthorized movement within a network. Because attackers often use stolen data to launch secondary attacks, such as phishing, maintaining high levels of awareness regarding social engineering is critical for protecting both corporate and customer data. Organizations must also prepare for the regulatory implications of data breaches, particularly when sensitive identity documents and transaction details are involved, to ensure they can meet compliance requirements during an investigation.