RansomHub ransomware group lists www.clevo.com.tw on its leak site

• Ransomware group: RansomHub
• Country: Tuvalu
• Sector: Technology
• Announcement date: June 4, 2024

The RansomHub ransomware group has claimed responsibility for a cyberattack against the Taiwan-based technology manufacturer Clevo. According to an announcement made on a leak site on June 4, 2024, the threat actor group alleges that they have successfully breached the organization's network and exfiltrated a significant amount of information.

The details of the alleged attack

RansomHub claims that the breach involved the encryption of both Clevo's primary networks and their backup systems. This type of attack is characteristic of modern ransomware operations, which often employ a double extortion tactic. In such scenarios, attackers do not merely lock the victim's files to demand a ransom for decryption; they also steal sensitive data beforehand and threaten to leak it publicly if their demands are not met. This increases the pressure on the victim, as the threat of a data leak can cause significant reputational and legal damage even if the organization can restore its systems from backups.

The threat group has stated that they intend to publish technical documents that may violate non-disclosure agreements (NDAs) held between Clevo and its various partners and clients. Furthermore, the group alleges that the company has not responded to their ransom demands or entered into any negotiations regarding the incident.

The scope of the alleged data theft

The group claims to have stolen approximately 200 GB of data during the operation. The stolen information is said to include highly sensitive technical documentation and strategic business files. The alleged leaked data includes the following items:

• Technical drawings
• Product roadmaps
• Confidential partner documents

The files are reported to be in a wide variety of formats, which suggests a deep penetration into technical and administrative directories. The formats mentioned include pdf, pptx, ppt, dwg, dxf, prt, sldprt, asm, sldasm, sdcpc, sdac, sdcc, doc, dwt, dws, and sdp.

Potential impact and industry implications

This breach could potentially compromise Clevo's trade secrets and its strategic relationships with its business partners. Because the shared samples may contain confidential technical specifications belonging to major technology firms such as Intel, Nvidia, and Micron, the incident could create negative impacts across the broader supply chain. When a manufacturer in the technology sector is compromised, the ripple effects can extend to the global companies that rely on their components and expertise.

The organization may also face specific legal obligations. Under Taiwanese law and international data protection standards, the company may be required to notify relevant authorities and affected parties about the breach. Additionally, there are secondary risks involved, such as the possibility of competitors exploiting the leaked data or the organization suffering long-term reputational damage.

Security considerations for the technology sector

For organizations operating in the technology manufacturing sector, this incident highlights the importance of robust cybersecurity frameworks. Protecting intellectual property, such as technical drawings and product roadmaps, is critical to maintaining a competitive advantage. Organizations often implement defensive measures such as network segmentation, multi-factor authentication, and rigorous access controls to mitigate these risks.

Furthermore, the claim that backups were encrypted suggests a need for offline or immutable backup solutions that cannot be reached by ransomware during an active encryption phase. As RansomHub is known as a Ransomware-as-a-Service (RaaS) group that emerged in early 2024 and reportedly ceased operations in early 2025, the group may be inclined to release stolen data rapidly to maximize their impact before their operational capacity diminishes. This urgency requires organizations to have well-tested incident response plans to manage the fallout of a potential data leak.