RansomHub ransomware group lists tellurianinc.org on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Energy & Utilities
• Announcement date: September 23, 2024

RansomHub claims responsibility for Tellurian Inc. data breach

The RansomHub ransomware group has listed data on its leak site, claiming it belongs to Tellurian Inc. The announcement, which appeared on September 23, 2024, indicates that the threat actor group has targeted the American energy company, claiming to have successfully exfiltrated various types of sensitive information from the organization's network.

According to the claims made by the group, the breach involves the theft of confidential documents, proprietary data, and budget files. The group has stated that if the organization does not meet their ransom demand, the stolen data will be sold on the dark web. It is important to note that no specific ransom demand has been disclosed, and no specific data size or file count has been provided in the announcement.

Details of the alleged data exfiltration

The content of the allegedly exfiltrated data is substantial, involving various aspects of the company's internal operations and business relationships. Based on the information provided by the attackers, the data includes sensitive documents that could impact the company's competitive standing and operational privacy. Screenshots provided by the group purportedly show samples of financial statements, project summaries, and corporate correspondence.

The specific types of data mentioned in the listing include:

• Non-disclosure agreements (NDAs)
• Budget reports
• Financial data
• Business partner information
• Technical project documents

The inclusion of such diverse data types suggests a broad access to the organization's internal file systems, ranging from high-level financial planning to technical project details and legal agreements.

About Tellurian Inc.

Tellurian Inc. is an American energy company that operates within the energy and utilities sector. The company is primarily focused on natural gas production and the development of liquefied natural gas (LNG) infrastructure. Additionally, the organization is involved in global energy trading. Tellurian Inc. aims to meet global energy demand by developing low-cost energy solutions.

Impact and broader implications of the incident

This incident may create negative impacts on the organization's operational confidentiality and commercial reputation. Given the nature of the leaked data, secondary risks and a loss of trust may be observed among the organization's business partners and investors. Furthermore, as a US-based entity, data protection obligations under relevant state laws and federal regulations may become a concern for the company.

RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. The group reportedly incorporated former affiliates of the ALPHV group and was reported to have ceased operations in early 2025. Ransomware attacks like this often utilize a "double extortion" tactic, where attackers not only encrypt a company's systems but also steal sensitive data to use as leverage for ransom payments. This method increases the pressure on the victim, as the threat of public data exposure remains even if systems are restored from backups.

For organizations in the energy and utilities sector, such incidents highlight the critical need for robust cybersecurity frameworks. To mitigate such risks, organizations typically need to conduct thorough forensic investigations to determine the full scope of any leaked data and ensure that all affected parties are notified according to legal requirements. Maintaining strict access controls, implementing multi-factor authentication, and conducting regular security audits are standard defensive steps used to protect against unauthorized network access and data exfiltration.