RansomHub ransomware group lists nigico.gr on its leak site

• Ransomware group: RansomHub
• Country: Greece
• Sector: Technology
• Announcement date: December 28, 2024

RansomHub claims to have stolen data from Nigico

The RansomHub ransomware group has published an announcement on its dedicated leak site claiming responsibility for a cyberattack against Nigico. According to the group's post, which appeared on December 28, 2024, the threat actor has successfully breached the systems of the organization and has obtained various files. This announcement constitutes a claim of a cybersecurity breach targeting the institution's operations, though the organization has not issued a formal response regarding the validity of the incident.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers do not merely encrypt an organization's data to disrupt operations; they also threaten to release sensitive information publicly to pressure the victim into paying a ransom. By hosting stolen data on these platforms, cybercriminals aim to maximize the reputational and legal pressure placed on the target entity.

Details of the alleged data leak

The RansomHub group listed Nigico on its leak site on December 28, 2024, and subsequently published an announcement. The group claims to have shared various files that were obtained from the institution's systems. While the specific volume of data and the exact number of files have not been disclosed by the group, the announcement includes sample files to demonstrate the nature of the breach.

The content shared in the announcement includes several types of sensitive information. Based on the samples provided by the group, the affected data types include:

• Price lists
• Statistical data
• Commercial documents

The presence of such documents suggests that the breach may impact the internal business logic and commercial standing of the company. The disclosure of price lists and commercial documents can undermine competitive advantages, while statistical data may reveal internal performance metrics or client-related trends.

About Nigico

Nigico is a Greece-based engineering and technology company. The firm specializes in providing advanced technical solutions, primarily focusing on the fields of energy management, building automation, and industrial control systems. Due to its involvement in critical infrastructure sectors such as energy and industrial controls, the organization plays a role in the technological landscape of its region.

Analysis and potential implications

This leak claim may lead to the exposure of the institution's trade secrets and operational data. Because Nigico is based in Greece, the incident may result in legal consequences under the EU General Data Protection Regulation (GDPR). The content of the shared data may pose secondary risks to the institution's supply chain partners and customers, as the exposure of commercial and statistical data can create vulnerabilities for interconnected entities.

The group involved, RansomHub, emerged in early 2024 and has been reported to have ties to ALPHV. Such connections are significant in the threat intelligence landscape, as the methodologies used by one group often influence others. Furthermore, the nature of the data leaked can facilitate targeted phishing attacks, where attackers use stolen commercial information to craft highly convincing fraudulent communications.

It is important to note that reports indicating that RansomHub ceased operations in early 2025 suggest that existing listings on their leak site may represent a historical archive rather than an active ongoing negotiation. Despite this, the potential impact of such leaks remains a critical concern for organizations in the technology and engineering sectors. To mitigate these risks, organizations typically implement robust defensive measures, including multi-factor authentication, regular security audits, and comprehensive employee training to defend against the phishing attempts that often follow such breaches.