RansomHub lists data allegedly belonging to www.eebpsa.com.co

• Ransomware group: RansomHub
• Country: Colombia
• Sector: Energy & Utilities
• Announcement date: June 4, 2024

The ransomware group known as RansomHub has listed data allegedly belonging to the organization www.eebpsa.com.co on its leak platform. According to the announcement made on June 4, 2024, the group claims to have obtained a significant volume of sensitive information from the target.

Details of the alleged attack

The threat actor known as RansomHub has listed data allegedly belonging to www.eebpsa.com.co on its leak platform. The group claims to have obtained accounting and internal management data from the organization. While the announcement was made on June 4, 2024, the group claims the attack itself occurred on April 13, 2024. The total volume of the leaked data is stated to be 20 GB. No information was provided regarding the specific file count or the ransom demand associated with this incident.

Data types involved

Based on the screenshots provided by the threat actor, the leaked information includes a variety of sensitive corporate documents and financial records. The data is said to include:

• Accounting records
• Supplier information
• Bank account details
• Internal management documents

The contents of these files reportedly include invoice samples, supplier payment details, bank account information, and corporate management documents.

Threat actor profile

RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. It was reportedly known for absorbing affiliates from the ALPHV group. While the group was active during the period of this incident, it is said to have ceased operations in early 2025.

Impact and industry implications

The allegedly leaked data may contain sensitive information regarding the organization's financial operations and supply chain relationships. This could create negative impacts on the organization's commercial reputation and may pose secondary risks for third-party business partners. Furthermore, it is likely that the organization will face legal obligations under Colombian data protection regulations. The leak may jeopardize the organization's operational continuity and customer trust.

In the broader context of cybersecurity, such incidents often involve double extortion tactics. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to publish this data on a leak site, the attackers aim to pressure the victim into paying a ransom to prevent the public exposure of confidential information.

For organizations operating within the energy and utilities sector, or any sector handling sensitive financial and management data, these incidents highlight the critical importance of robust data protection strategies. Common defensive steps for organizations facing such threats include implementing strict access controls, maintaining offline backups, and conducting regular security audits. Additionally, monitoring for unauthorized data exfiltration and maintaining a comprehensive incident response plan are essential components of a modern cybersecurity posture to mitigate the risks posed by RaaS groups.