RansomHub ransomware group lists metalfrio.com.br on its leak site

• Ransomware group: RansomHub
• Country: Brazil
• Sector: Manufacturing
• Announcement date: July 18, 2024

RansomHub claims responsibility for Metalfrio data leak

The ransomware group known as RansomHub has published a listing on its leak site claiming to have stolen data belonging to the Brazilian company metalfrio.com.br. According to the announcement made on July 18, 2024, the threat actors assert that they successfully infiltrated the organization's systems around July 16, 2024. The group is currently offering various sensitive files for sale on their platform, marking a significant potential exposure for the targeted entity.

Details of the alleged data theft

The threat actor known as RansomHub has listed various technical and financial documents on its leak site, claiming they belong to metalfrio.com.br. The group asserts that these files were obtained directly from the organization's systems. The announcement indicates that technical drawings and other sensitive files containing intellectual property are being offered for sale to the highest bidder.

The allegedly leaked data includes a wide range of sensitive information that could impact the company's operations and competitive standing. Based on the information provided by the attackers, the stolen content includes:

• Product technical drawings (in DWG, ANC, and MNC formats)
• Financial records
• Supplier information
• Client information
• NDA agreements

The provided screenshots accompanying the leak site announcement display various contract samples, insurance certificates, and technical schematics, further supporting the group's claims regarding the nature of the stolen data.

About Metalfrio

Metalfrio is a Brazil-based company specializing in the design, manufacturing, and sale of commercial refrigeration solutions and cooling cabinets. The company provides refrigeration equipment for the beverage and food retail sectors worldwide.

Operational risks and industry implications

The alleged leak may pose operational risks due to the potential exposure of the organization's intellectual property and trade secrets. The disclosure of client and supplier data could lead to a loss of trust in third-party relationships and potential legal repercussions. Under Brazil's LGPD, the organization may face administrative fines if violations regarding the protection of personal data are confirmed. Furthermore, the leaked financial and contractual data could be utilized for targeted phishing or fraud attempts against the organization's supply chain.

RansomHub is a RaaS structure that emerged in early 2024, reportedly incorporating former members of the ALPHV group; the group is reported to have ceased operations in early 2025.

In modern cyberattack landscapes, ransomware groups often employ a double extortion tactic. In this scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak confidential data on public forums or leak sites, attackers increase the pressure on the victim to pay the ransom. This method is particularly damaging to manufacturing firms where intellectual property and technical schematics represent core business value.

For organizations in the manufacturing and supply chain sectors, defending against such threats requires a multi-layered security approach. Implementing robust access controls and multi-factor authentication can help prevent unauthorized entry into sensitive systems. Additionally, regular monitoring of network traffic and the use of endpoint detection and response tools can assist in identifying suspicious activity before data exfiltration occurs. Protecting intellectual property specifically requires strict data loss prevention (DLP) strategies to ensure that technical drawings and proprietary designs do not leave the secure corporate environment.