RansomHub ransomware group lists powiatjedrzejow.pl on its leak site

• Ransomware group: RansomHub
• Country: Poland
• Sector: Government & Defense
• Announcement date: October 16, 2024

The RansomHub ransomware group has officially listed the domain powiatjedrzejow.pl on its leak site, claiming to have successfully compromised the systems of the Jędrzejów County administration in Poland. According to the group's announcement, the attack resulted in the exfiltration of sensitive information belonging to approximately 80,000 citizens.

The ransomware attack and group claims

The threat actor known as RansomHub announced the attack on October 16, 2024, following an alleged infiltration that occurred on October 15, 2024. The group claims to have gained unauthorized access to the institution's internal systems and successfully copied a significant amount of sensitive information belonging to local residents.

In their public announcement, the attackers stated that they are threatening to either publish the stolen data on their leak site or sell it to other malicious actors. The group cited a lack of communication with the institution as the primary reason for this escalation. This tactic is a hallmark of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt data to disrupt operations but also steal it to use as leverage for extortion purposes.

Affected data types

The group alleges that the stolen data contains highly sensitive personal information. The specific categories of data claimed to be involved include:

• Full names
• Parents' names
• Gender
• Permanent residence addresses
• Phone numbers
• PESEL identification numbers
• Personal status
• E-mail addresses

Organization profile

Powiat Jędrzejowski is a county administration located in the Świętokrzyskie Voivodeship of Poland. It serves as an official institution responsible for managing local government services, administrative processes, and public announcements within the region.

Risk assessment and implications

This claim suggests that approximately 80,000 citizens who utilize local government services in Poland may face significant risks, including identity theft and fraud. The exposure of PESEL identification numbers is particularly concerning, as these unique identifiers can create long-term security risks for victims and facilitate highly targeted phishing attacks.

Because the breach involves personal data of citizens, the institution may be required to fulfill data breach notification obligations under the European Union's General Data Protection Regulation (GDPR). Such regulatory requirements ensure that individuals are informed when their sensitive information has been compromised, allowing them to take protective measures.

RansomHub is a group that emerged in early 2024 and has been reported to have ties to the ALPHV ransomware group. The targeting of public institutions by such groups suggests a trend where attackers focus on high-value targets that manage essential citizen services. The nature of these attacks indicates that public sector entities may see an increase in such incidents, often involving secondary extortion methods where attackers use the threat of data exposure to pressure organizations into paying ransoms.

For organizations in the government and defense sector, maintaining robust cybersecurity postures is critical. This typically involves implementing multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized access or data exfiltration attempts. Given the sensitive nature of the data managed by local administrations, the potential impact of a successful breach extends far beyond immediate operational disruption, reaching into the long-term security and privacy of the general population.