RansomHub ransomware group lists ondaralogistica.com on its leak site

• Ransomware group: RansomHub
• Country: Spain
• Sector: Transportation
• Announcement date: February 23, 2025

RansomHub claims data breach at Ondara Logistica

The ransomware group known as RansomHub has added the Spanish organization ondaralogistica.com to its leak site. According to the announcement made on February 23, 2025, the threat actor claims to have successfully exfiltrated a significant volume of data from the company's internal systems.

This type of activity is characteristic of modern ransomware operations, which often employ double extortion tactics. In these scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish stolen data on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or personal information.

Details of the alleged attack

The threat actor's listing indicates that the alleged attack took place on February 18, 2025. While the group has publicly identified the target, they have not provided specific details regarding the nature of the breach or the exact contents of the stolen files. The listing confirms the following regarding the claimed data volume:

• The group claims to have obtained 120 GB of data.

Despite the specified volume of 120 GB, the listing names no specific data types or a detailed list of the files involved in the breach.

About Ondara Logistica

Ondara Logistica is a logistics and transport company based in Spain. The organization operates within the transportation sector, specifically focusing on road freight transport and distribution services.

Potential risks and industry implications

The alleged leak poses several significant risks to the organization. From an operational standpoint, such incidents can threaten business continuity. From a commercial perspective, the exposure of data can severely damage the company's reputation with clients and partners. Furthermore, because the entity operates in Spain, it may face legal consequences under the General Data Protection Regulation (GDPR) regarding the protection of personal data.

Depending on the actual content of the leaked data, there are emerging risks such as identity theft or the possibility of targeted phishing attacks directed at the organization's employees or business partners. The exposure of supply chain data is particularly concerning, as it can potentially increase the risk of secondary attacks against other entities within the logistics network.

RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. The group reportedly attracted various affiliates following the ALPHV incident. While there have been reports suggesting the group ceased operations in early 2025, they have remained active in listing victims on their platform.

To defend against such threats, organizations in the transportation and logistics sector often implement various defensive measures. These include robust backup strategies, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Maintaining strict access controls and conducting regular security awareness training can also help mitigate the risk of initial access through phishing or other common vectors.