RansomHub ransomware group lists payxpress.co.il on its leak site

• Ransomware group: RansomHub
• Country: Israel
• Sector: Financial Services
• Announcement date: October 27, 2024

RansomHub claims data breach against Payxpress

The ransomware group known as RansomHub has officially listed the Israel-based company payxpress.co.il on its leak site. According to the group's announcement, which was made on October 27, 2024, the organization has been targeted in a cyberattack resulting in a data breach. The threat actor alleges that they have successfully exfiltrated various documents from the company's digital payment infrastructure.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms by threatening to release sensitive information. In many modern attacks, groups employ a tactic known as double extortion. In this scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information beforehand. If the ransom is not paid, the group threatens to publish the stolen data on these public leak sites, causing significant reputational and legal damage to the victim.

The listing by RansomHub suggests a targeted operation aimed at the digital assets of the organization. While the group has made these claims, the specific details regarding the total volume of data stolen or the exact amount of the ransom demand have not been provided by the attackers.

Details of the alleged data theft

The threat actor has published various screenshots and documents that they claim were obtained from the internal systems of the company. These shared images purportedly contain a wide range of sensitive documentation that could be used for malicious purposes. The information released by the group appears to include both personal identification documents and various commercial forms associated with the entity.

Based on the information provided by the attackers, the following types of data are included in the breach:

• Identity information
• Driver's license information
• Commercial contracts
• Job application forms

The presence of such diverse data types, ranging from government-issued identification to internal business agreements, highlights the potential breadth of the unauthorized access. When such sensitive information is leaked, it often leads to secondary risks for the individuals involved, such as identity theft and various forms of financial fraud.

About Payxpress

Payxpress is an Israel-based financial technology company that provides digital payment solutions for businesses and consumers. Their platform focuses on providing secure and efficient online payment processing services for various industries. As a provider of financial technology, the company operates within a sector that requires high levels of data protection and trust.

Impact and security implications

The alleged leak of this data carries significant implications for both the organization and the individuals whose information was compromised. Because Payxpress operates within the financial services sector, a breach of this nature could negatively impact customer trust. Furthermore, the company may face legal sanctions under Israeli data protection regulations due to the exposure of sensitive personal and commercial information.

The specific threat actor, RansomHub, has a reported history of absorbing affiliates from other groups, such as ALPHV. This organizational evolution suggests that the group may employ sophisticated secondary extortion tactics. For the affected individuals, this increases the long-term risk of being targeted by phishing campaigns or other highly specific, targeted attacks that leverage the stolen personal details.

Organizations operating in the financial services sector typically focus on robust defensive measures to mitigate these risks. This includes implementing strong encryption for data at rest and in transit, enforcing multi-factor authentication across all systems, and maintaining rigorous monitoring of network traffic to detect unauthorized exfiltration. Additionally, regular security audits and strict adherence to regional data protection laws are essential components of a comprehensive cybersecurity posture to prevent such incidents and manage the fallout if a breach occurs.