RansomHub ransomware group lists www.cloudeurope.it on its leak site

• Ransomware group: RansomHub
• Country: Italy
• Sector: Technology
• Announcement date: June 27, 2024

RansomHub claims massive data theft against cloudeurope.it

The RansomHub ransomware group has officially listed the technology company cloudeurope.it on its leak site, claiming a major security breach. According to the announcement made on June 27, 2024, the threat actors allege they have successfully compromised the organization's infrastructure. This development follows a claimed attack date of June 22, 2024, marking a significant escalation in the group's activities targeting the technology sector.

The group's claims suggest a sophisticated level of access. RansomHub alleges that they have not only encrypted the servers belonging to cloudeurope.it but have also successfully exfiltrated a massive volume of information. The scale of the alleged theft is substantial, with the group claiming that over 70TB of data has been taken from the company's systems.

Details of the alleged intrusion and persistence

The threat actors have made several alarming claims regarding the depth of their access within the victim's network. Beyond the initial encryption of servers, RansomHub alleges that they have maintained persistence within the company's network. This implies that the attackers may have established long-term access, allowing them to move laterally through the infrastructure and remain undetected for a period of time.

Furthermore, the group's claims extend beyond the primary target. The threat actors allege that they have also maintained persistence within the systems of the company's business partners. This claim introduces significant concerns regarding supply chain security, as the breach may have implications for the broader ecosystem of partners connected to the organization. To support their claims, the group has shared screenshots on their leak site, which include various files such as employee identification documents and training certificates.

The scope of the compromised data

The data allegedly stolen by the RansomHub group is vast and contains highly sensitive information. The group claims the total volume of the stolen corporate files reaches 70TB. Based on the information provided by the threat actor, the affected data includes:

• Employee identification data
• Employee health records
• Training certificates
• Corporate infrastructure data

The exposure of such diverse data types—ranging from identity documents to infrastructure details—presents a multi-faceted risk to the organization and its stakeholders.

Implications and organizational risks

This incident poses a significant risk to the operational continuity of cloudeurope.it. For an organization operating within Italy, such a breach carries heavy legal implications. The exposure of personal data can trigger legal obligations and administrative sanctions under the General Data Protection Regulation (GDPR). The potential for regulatory scrutiny following a breach of this magnitude is a critical concern for any modern enterprise.

Beyond legal and regulatory consequences, there are severe secondary risks for the individuals involved. The exposure of employee identification cards, health cards, and other personal identifiers creates a high risk of identity theft. Furthermore, such data can be used by malicious actors to conduct highly targeted phishing attacks against employees, using their personal information to gain further trust and access.

The tactics employed by RansomHub appear to align with known double-extortion methods. In these scenarios, attackers do not just encrypt data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release stolen data publicly, the group aims to exert maximum pressure on the organization to meet their demands. This strategy turns a technical disruption into a reputational and legal crisis.

For companies in the technology sector, this incident highlights the critical importance of robust supply chain security. As attackers target business partners to reach primary targets, organizations must implement rigorous security standards for all connected entities. Defensive measures typically include implementing zero-trust architectures, maintaining strict network segmentation to prevent lateral movement, and ensuring comprehensive monitoring to detect unauthorized persistence. Additionally, organizations should prioritize regular backups and robust incident response plans to mitigate the impact of both encryption and data exfiltration events.