RansomHub ransomware group lists www.aswgr.com on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Manufacturing
• Announcement date: February 4, 2025

RansomHub claims a data breach at ASW Global

The ransomware group known as RansomHub has published a listing on its leak site claiming to have exfiltrated data belonging to ASW Global (aswgr.com). According to the announcement made on February 4, 2025, the threat actor claims to have successfully stolen documents and has made them available to the public.

The claim involves a significant amount of sensitive information allegedly related to the organization's internal operations and its workforce. RansomHub has asserted that the data was exfiltrated from the company's systems, marking this as a data leak event rather than a simple encryption attack. While the group has posted these claims on their dedicated leak site, the full extent of the breach and the validity of the files have not been independently verified.

Details of the alleged data exfiltration

The threat actor has provided various materials to support their claims, including screenshots that purportedly show the stolen information. The content of these screenshots suggests a wide range of sensitive documentation has been compromised. The types of data allegedly included in the leak are:

• Financial reports
• Employment contracts
• Passport information
• Customs documents
• Payroll records
• Credit card information

The presence of such diverse data types indicates that the breach may have touched multiple departments within the organization, ranging from human resources and finance to logistics and customs operations. The inclusion of highly sensitive personal identifiers, such as passport copies and credit card details, significantly elevates the severity of the incident.

About ASW Global

ASW Global is an American company based in the United States. The organization provides a variety of specialized services, including logistics, supply chain management, and packaging solutions. Furthermore, the company specializes in providing outsourcing and operational support services to its clients.

Implications and risk assessment

The alleged leak of this data carries substantial risks for both the organization and the individuals involved. For the employees and business partners of ASW Global, the exposure of passport information, employment contracts, and payroll records significantly increases the risk of identity theft and financial fraud. Furthermore, the exposure of credit card information poses an immediate threat to the financial security of the affected parties.

From a regulatory perspective, the disclosure of such sensitive personal data may lead to significant compliance issues under data protection regulations, such as the General Data Protection Regulation (GDPR) or other relevant local laws. Additionally, the exposure of operational data and customs documents could lead to the disclosure of trade secrets, potentially resulting in reputational damage for the company.

It is important to note that RansomHub has been reported to be linked to the former ALPHV group. Such groups are often associated with double-extortion tactics, a method where attackers not only encrypt a victim's data but also steal it and threaten to leak it publicly unless a ransom is paid. This tactic is designed to maximize pressure on the target organization by threatening their reputation and legal standing.

In response to such incidents, it is generally advised that organizations undergo a comprehensive forensic analysis to determine the exact scope of the leaked data and identify the entry point used by the attackers. For companies operating in the logistics and supply chain sectors, maintaining robust security protocols and monitoring for unauthorized data exfiltration is a critical component of defensive strategy.