RansomHub ransomware group lists www.afnigc.ca on its leak site

• Ransomware group: RansomHub
• Country: Canada
• Sector: Government & Defense
• Announcement date: March 25, 2025

The ransomware group known as RansomHub has published a leak announcement on its platform, claiming to have compromised data belonging to the Assembly of First Nations - Information Governance Centre (AFNIGC). This announcement, posted on March 25, 2025, marks a new development in the group's ongoing activities targeting various entities.

The alleged attack and group claims

According to the information released by the threat actor, the group gained unauthorized access to the systems of the organization, specifically targeting the domain afnigc.ca. The announcement, which appeared on the group's leak site, includes claims that the group successfully exfiltrated data from the victim's infrastructure. To support these claims, the group has shared various documents as alleged proof of the compromise.

Ransomware attacks often involve a tactic known as double extortion, where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to release stolen data on a public leak site, threat actors aim to pressure the victim into paying a ransom. While the specific details regarding the method of entry or the exact timing of the intrusion remain unconfirmed by the victim, the group's publication serves as a public claim of a successful breach.

Data types involved in the leak

The screenshots provided by the threat actor as evidence of the breach suggest that the stolen information includes a mix of corporate and personal data. The leaked content is reported to contain various sensitive documents that could impact both the organization and the individuals involved. The specific types of data mentioned in the announcement include:

• Administrative documents
• Insurance premium information
• Event contracts
• Cash advance requests
• Loan agreements

The presence of such diverse documentation suggests that the breach may have touched upon various administrative and financial workflows within the organization. No information was provided regarding the total size of the data stolen or the specific number of files compromised.

About the affected organization

The target of this alleged attack is AFNIGC, which stands for the Assembly of First Nations - Information Governance Centre. Based in Canada, this organization is dedicated to data management, research, and information sovereignty for First Nations communities. Their mission involves developing strategies to protect Indigenous data and ensuring that these communities maintain full control over their own information.

Analysis and potential consequences

The data allegedly leaked by RansomHub may contain highly sensitive financial and personal information belonging to employees and third parties. Such a breach poses a significant risk of identity theft and could be used to launch targeted phishing attacks against the affected individuals. Because the organization operates within Canada, the incident may lead to legal and administrative consequences under data protection regulations, such as the Personal Information Protection and Electronic Documents Act (PIPEDA).

RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. It gained notoriety for attracting affiliates following the dissolution of the ALPHV group. Although there were reports that their activities might have ceased in early 2025, such claims do not eliminate the risks associated with secondary exploitation and ongoing data security breaches. For organizations in the government and defense sectors, maintaining robust defensive measures is critical. This includes implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to mitigate the risk of unauthorized access and data exfiltration.