RansomHub ransomware group lists www.core-1.com on its leak site

• Ransomware group: RansomHub
• Sector: Technology
• Announcement date: March 21, 2025

The RansomHub ransomware group has announced that it has successfully targeted the organization core-1.com. According to a post made on the group's leak site, the attackers claim to have exfiltrated a significant volume of sensitive information belonging to the entity.

Details of the claimed attack

The announcement regarding the breach of core-1.com was published on March 21, 2025. In the claim, the RansomHub group asserts that they have obtained a substantial amount of data from the institution's internal systems. The total volume of the data allegedly stolen is approximately 71 GB, which is comprised of 54,762 individual files. To support their claim, the group provided screenshots that appear to show samples of the organization's internal file directories and various commercial documents.

Ransomware attacks often involve a strategy known as double extortion. In this scenario, threat actors do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release private data on public leak sites, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or regulated information. This method increases the pressure on organizations, as the leak of data can lead to significant reputational and legal consequences even if the organization can recover its systems from backups.

Data involved in the leak

The files identified in the leak claim represent a variety of sensitive corporate information. Based on the screenshots provided by the group, the leaked data includes several types of critical documentation. The specific categories of data mentioned in the announcement include:

• License agreements
• Vendor contracts
• Insurance documents
• Corporate correspondence

The presence of such documents suggests that the breach encompasses a wide range of operational and legal information. When such data is exposed, it can provide malicious actors with insights into the inner workings of a company, its business relationships, and its legal obligations.

RansomHub background

RansomHub is identified as a Ransomware-as-a-Service (RaaS) group that first emerged in early 2024. It has been reported that the group absorbed various affiliates following the activities of the ALPHV group. While there were reports suggesting that their operations might have ceased in early 2025, the current claims may represent a continuation of past activities or a resurgence of the group's operations.

Risk assessment and organizational impact

The potential impact of this alleged leak is multifaceted. For core-1.com, the exposure of these documents may pose significant risks to its ongoing commercial operations and its established supply chain relationships. Because the leaked data contains vendor contracts and license agreements, there is a secondary risk that third parties involved in these contracts could become targets of further attacks. This interconnectedness is a common concern in modern cybersecurity, as a breach in one organization can create a ripple effect through its entire network of partners and suppliers.

Furthermore, the nature of the leaked files, which include corporate records and legal documents, may lead to legal sanctions. Depending on the specific region where the organization operates, the exposure of such data could trigger investigations and penalties under the General Data Protection Regulation (GDPR) or other local data protection regulations. The legal ramifications of a data breach can be extensive, involving not only regulatory fines but also potential litigation from affected parties.

To defend against such threats, organizations typically implement a multi-layered security approach. This includes maintaining robust backup solutions that are isolated from the main network, implementing strict access controls to limit the movement of attackers within a system, and conducting regular security audits. Additionally, monitoring for unauthorized data exfiltration and maintaining a clear incident response plan are essential steps for mitigating the damage caused by ransomware and data leak events.