RansomHub ransomware group lists planetgroup.co.il on its leak site

• Ransomware group: RansomHub
• Country: Israel
• Sector: Technology
• Announcement date: December 20, 2024

RansomHub claims data breach against Planet Group

The RansomHub ransomware group has listed data on its leak site that it claims belongs to planetgroup.co.il. This announcement, made on December 20, 2024, follows a claimed attack date of December 18, 2024. While the group has published a listing, no information was given regarding the total size of the data, the specific file count, or a ransom demand.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information before the encryption phase. The attackers then threaten to leak this stolen data on public forums or specialized leak sites if the ransom is not paid. This pressure is designed to exploit the reputational and regulatory risks associated with data exposure, forcing organizations to choose between paying a ransom and facing public disclosure of their internal information.

Details of the claimed attack

According to the announcement made by the RansomHub group, they claim to have gained unauthorized access to the systems belonging to planetgroup.co.il. The group asserts that they have obtained various files from the organization's infrastructure. To support their claim, the group has shared several sample files as part of their public announcement.

The content of these sample files, as displayed in screenshots provided by the attackers, includes various business-related documents. Specifically, the leaked materials appear to consist of:

• Cost spreadsheets
• Brand lists
• Various business documents

The presence of such documents suggests that the attackers have targeted internal administrative and operational records rather than just technical configurations.

Affected data categories

Based on the information released by the ransomware group, the breach involves several categories of sensitive information. The data identified in the leak appears to impact the following areas:

• Financial data
• Business operational data

The exposure of such data can have significant implications for an organization's internal management and external relationships. When financial and operational documents are leaked, it can compromise the integrity of business processes and expose the inner workings of the company's commercial strategy.

About Planet Group

Planet Group is an Israel-based technology and IT services company. The organization provides a wide range of professional services, including software solutions, system integration, and technological infrastructure support to various corporate clients.

Risk assessment and industry implications

The leak may pose significant risks to the organization's commercial operations and its supply chain data. The content of the shared documents may contain sensitive information regarding the organization's cost structure and brand management. Furthermore, as an Israel-based organization, potential non-compliance with local data protection regulations may be observed as a result of this incident.

The threat actor involved, RansomHub, is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. It was reportedly composed of affiliates from the ALPHV group. Reports indicate that RansomHub ceased operations in early 2025. Despite the reported cessation of operations, the impact of their previous attacks can persist for years through the availability of leaked data.

This incident highlights the secondary risks inherent in supply chain vulnerabilities. The organization's customers and business partners may be at risk of secondary attacks or targeted phishing attempts. When an IT service provider is compromised, the attackers often use the stolen information to launch more sophisticated, targeted campaigns against the provider's clients. These secondary attacks often use the stolen context—such as brand names or business processes—to make phishing emails appear legitimate and trustworthy.

To defend against such threats, organizations in the technology and IT services sector typically implement multi-layered security strategies. This includes maintaining strict access controls, implementing robust monitoring to detect unauthorized system access, and ensuring that sensitive business and financial data is encrypted both at rest and in transit. Additionally, organizations often engage in regular security awareness training to help employees identify the phishing attempts that frequently follow a data breach.