RansomHub ransomware group lists diazfoodsolutions.es on its leak site

• Ransomware group: RansomHub
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: December 27, 2024

The RansomHub ransomware group has listed data on its leak site that it claims belongs to diazfoodsolutions.es. This announcement, made on December 27, 2024, marks a new development in the group's ongoing activities targeting various sectors.

The claimed attack and event details

According to the announcement made by the threat actor known as RansomHub, the group added diazfoodsolutions.es to its leak site on December 27, 2024. The group claims to have gained unauthorized access to the organization's systems and subsequently obtained various files. While the group claims the attack occurred on December 26, 2024, the public listing followed the next day.

In line with common ransomware tactics such as double extortion, where attackers not only encrypt data but also threaten to leak it to pressure victims, the group has published several documents as samples. These samples are intended to demonstrate the validity of their claims and to increase pressure on the target organization by showcasing the sensitive nature of the stolen information.

Data involved in the leak

The information shared on the leak site includes several types of documents that appear to be related to the company's commercial operations. The group has provided samples in both PDF and XLSX formats to illustrate the content they have allegedly exfiltrated. The specific types of data mentioned in the announcement include:

• Financial statements
• Sales reports
• Subsidy data

No information was provided regarding the total size of the data stolen or the specific number of files involved in the breach. Additionally, no information was given regarding a ransom demand.

About diaz food solutions

Diaz Food Solutions is a food industry supplier based in Spain. The company operates in the processing, packaging, and distribution of food products, making it a key player within its regional supply chain.

Analysis and potential implications

This leak may lead to the exposure of the organization's commercial and financial data. Because the company operates in Spain, it may face administrative sanctions due to data protection obligations under the GDPR. Furthermore, the content of the shared data could create secondary risks for the organization's supply chain and business partners, potentially impacting the trust and security of the broader food production network.

RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024 and reportedly absorbed affiliates from ALPHV. Although its activities were reported to have ceased in early 2025, this specific situation may increase the possibility that the data held by the group could be republished on different platforms in the future.

For organizations operating in the food and agriculture sectors, such incidents highlight the necessity of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.