RansomHub ransomware group lists savannahcandy.com on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: September 21, 2024

RansomHub claims data breach at Savannah Candy Kitchen

The ransomware group known as RansomHub has listed the organization Savannah Candy Kitchen, which operates under the domain savannahcandy.com, on its dedicated leak site. This announcement, made on September 21, 2024, follows a claimed attack date of September 20, 2024. The listing serves as a public claim by the threat actor that they have successfully compromised the organization's internal networks and exfiltrated sensitive information.

Ransomware leak sites are a common tool used by cybercriminal groups to exert pressure on victims. In many modern ransomware campaigns, groups employ a strategy known as double extortion. In this scenario, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of leaking this stolen data on a public site is used as leverage to coerce the victim into paying a ransom. While the specific ransom demand and the exact volume of data stolen have not been disclosed by the group, the presence of the company on the leak site indicates a significant security incident.

Details of the alleged data exposure

To support their claim of unauthorized access, RansomHub has shared various screenshots as evidence. These images appear to confirm that the attackers have gained access to internal operational file directories and sensitive databases. The screenshots provided by the group suggest that the breach involves a wide range of internal company information, indicating a deep intrusion into the organization's digital environment.

According to the evidence presented by the threat actor, the following types of data have been compromised:

• Customer contact information
• Financial data
• Order records
• Human resources data

The visual evidence shared by the group reportedly includes financial income and expense reports, as well as customer databases containing names, addresses, and phone numbers. Furthermore, the screenshots show internal company file directory structures and various order records, providing a glimpse into the organization's internal operations and administrative workflows.

About Savannah Candy Kitchen

Savannah Candy Kitchen is an American food company that specializes in the production of traditional Southern-style confections. Their product line includes items such as pralines and pecan pies. Using family recipes, the company offers a diverse selection of sweets, gift baskets, and various products intended for corporate gifting.

Analysis and potential impact

The disclosure of the alleged data carries significant risks for both the organization and its stakeholders. For the customers of Savannah Candy Kitchen, the exposure of contact information and order history may lead to secondary risks, such as identity theft or targeted phishing attacks. When personal details are leaked, attackers often use them to craft highly convincing fraudulent communications designed to trick individuals into revealing even more sensitive information.

From a corporate perspective, the exposure of financial data can result in the loss of trade secrets and a significant loss of competitive advantage. Furthermore, as a United States-based entity, the organization may face complex legal obligations. Depending on the nature of the data and the residency of the affected individuals, the company may be required to comply with data breach notification obligations mandated by various state laws and federal regulations.

RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. The group is known to have attracted former affiliates from the ALPHV group. Although reports suggest the group may have ceased operations in early 2025, the methodologies and data exfiltration strategies used by the group remain a persistent threat to organizations. To defend against such threats, organizations in the food production and agriculture sectors should prioritize robust security measures, such as multi-factor authentication, regular network monitoring, and comprehensive data encryption, to protect their digital assets and sensitive information.