RansomHub ransomware group lists polaris-SOLUCIONES TECNOLÓGICAS PARA EMPRESAS -- polaris.es on its leak site

• Ransomware group: RansomHub
• Country: Spain
• Sector: Technology
• Announcement date: April 27, 2024

RansomHub claims data breach at Polaris Soluciones Tecnológicas Para Empresas

The RansomHub ransomware group has published an announcement on its leak site claiming that the Madrid-based technology firm polaris.es has been compromised. According to the post made by the group, the data belonging to the organization has been exfiltrated. The announcement, which was posted on April 27, 2024, identifies the target as the Spanish company polaris.es.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's internal systems but also steal sensitive information, threatening to release it publicly if their demands are not met. This method increases the pressure on companies by threatening their reputation and legal standing.

Details of the claimed attack

The RansomHub group's announcement specifically references the core business operations of polaris.es, particularly its work in custom application development and business software. The group claims that the volume of data stolen during the attack is approximately 165 GB. While the group has made this claim via their leak site, they have not provided a specific file count or a ransom demand in their public post.

The incident was announced on the same day it was allegedly carried out, according to the group's claims. While the group's activities are a significant concern for cybersecurity professionals, it is important to note that the group emerged in early 2024 and reportedly incorporated various affiliates from the ALPHV group. Reports indicate that the group's operations ceased in early 2025.

Potential impact on data and processes

The group has not provided a detailed breakdown regarding the specific content of the leaked data. However, the announcement suggests that the breach may affect information related to several key areas of the company's operations. These areas include:

• Business software
• Technical services
• Web development processes

Because the specific contents of the 165 GB of data have not been fully detailed by the attackers, the exact scope of the compromise remains unclear. In many such breaches, the lack of transparency from the threat actor makes it difficult for the victim to immediately assess the full extent of the exposure.

About Polaris Soluciones Tecnológicas Para Empresas

Polaris is a technology company based in Spain. The organization provides a variety of professional services, including software solutions, IT consulting, and various digital transformation services for businesses.

Risk assessment and organizational implications

This incident may pose a significant risk to the company's trade secrets and its customers' data. Given that the firm operates within Spain, a successful data breach of this nature could potentially trigger legal processes under the General Data Protection Regulation (GDPR). Such regulations impose strict requirements on how companies handle and protect personal data, and failures in data security can lead to substantial regulatory scrutiny.

The publication of company data on a leak site can lead to several downstream risks. For a technology service provider, this may result in targeted phishing attacks against their customer base or create broader supply chain risks. When a service provider is compromised, the attackers may use the stolen information to impersonate the provider or gain access to the systems of the companies they serve.

To defend against such threats, organizations in the technology sector typically implement various defensive measures. These include robust backup strategies, multi-factor authentication (MFA), and continuous monitoring of network traffic to detect unauthorized data exfiltration. Strengthening supply chain security and conducting regular audits of third-party access are also critical steps for companies that manage sensitive business software and client digital transformations.