RansomHub ransomware group lists www.castelligroup.com on its leak site

• Ransomware group: RansomHub
• Country: Italy
• Sector: Professional Services
• Announcement date: July 26, 2024

The RansomHub ransomware group has officially listed the Italian professional services firm Castelli Group on its dedicated leak site. According to the announcement made on July 26, 2024, the threat actors claim to have successfully breached the organization's network and exfiltrated various types of sensitive information. This development follows a pattern of double extortion, a common tactic used by modern ransomware groups where attackers not only encrypt a victim's systems but also steal sensitive data to use as leverage during negotiations.

The details of the alleged attack

The threat actor known as RansomHub published the listing for www.castelligroup.com on July 26, 2024. The group asserts that they have gained unauthorized access to the institution's internal network, allowing them to copy and exfiltrate various data sets. The announcement serves as a direct threat to the organization, stating that if the institution fails to meet the group's ransom demands, the stolen data will be released to the public.

While the specific ransom amount and the total volume of stolen data have not been disclosed by the group, the threat of public exposure remains a central component of their extortion strategy. Ransomware leak sites are frequently used by such groups to pressure victims by creating reputational and regulatory risks. By threatening to leak sensitive files, attackers aim to maximize the pressure on an organization to pay the ransom to prevent the disclosure of proprietary or personal information.

Data types involved in the leak

The screenshots provided by the threat actor suggest that the breach involves a wide variety of sensitive documents. The leaked content reportedly includes highly personal and professional information that could be used for malicious purposes. The following data types have been identified in the group's claims:

• Passport data
• Identity card information
• Official transport documents
• Corporate correspondence
• Commercial records

The presence of such sensitive documentation, including identity credentials and official transport records, significantly increases the potential impact of the breach. When identity documents are compromised, the risk of identity theft and targeted phishing attacks increases, as attackers can use the stolen information to impersonate individuals or create highly convincing fraudulent communications.

About Castelli Group

Castelli Group is an Italy-based management consulting and professional services firm. The company provides strategic consulting, operational support, and corporate management solutions to businesses. Given its role in providing high-level strategic and operational support, the firm handles significant amounts of corporate and client-related information.

Implications and potential risks

The alleged leak poses a significant risk of exposing personal data belonging to both employees and customers of the organization. Because Castelli Group is based in Italy, this incident may lead to potential data protection violations and administrative sanctions under the General Data Protection Regulation (GDPR). Organizations operating within the European Union must adhere to strict data handling and reporting standards, and a breach of this nature often necessitates a formal investigation.

RansomHub is recognized as a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. The group reportedly absorbed various affiliates following the activities of ALPHV. While reports suggest the group may have ceased operations in early 2025, the threat of data exposure remains a critical concern for the affected entity. To determine the full scope of the breach and the actual extent of the data exfiltration, the institution may need to conduct a comprehensive forensic investigation.

In response to such threats, organizations in the professional services sector typically focus on strengthening their defensive posture through multi-factor authentication, network segmentation, and continuous monitoring. Furthermore, implementing robust data encryption and maintaining regular, offline backups are essential steps to mitigate the impact of ransomware and data exfiltration events.