RansomHub ransomware group lists www.cormidom.com.do on its leak site

• Ransomware group: RansomHub
• Country: Dominican Republic
• Sector: Manufacturing
• Announcement date: March 25, 2025

RansomHub claims data breach against Cormidom

The ransomware group known as RansomHub has published an announcement on its leak site claiming to have stolen data belonging to Corporación Minera Dominicana (CORMIDOM), a mining company based in the Dominican Republic. The threat actor claims to have breached the organization's systems, leading to the potential exposure of a significant amount of sensitive corporate information.

Details of the claimed attack

According to the announcement posted on the RansomHub leak site on March 25, 2025, the group claims to have obtained a massive dataset from the organization. The group asserts that the stolen data consists of 212,913 files. While the specific date of the initial intrusion was not explicitly confirmed by the victim, the group claims the attack took place on March 18, 2025.

The leak site post includes various pieces of evidence intended to validate the group's claims. This includes screenshots that allegedly show the organization's internal documents, such as financial statements, budget reports, and various operational documents. Such tactics are common in double extortion ransomware attacks, where threat actors not only encrypt an organization's data but also threaten to release it publicly to increase pressure for ransom payments.

Alleged contents of the leaked data

The data allegedly exfiltrated by the threat actor is described as containing a wide range of sensitive information. The group claims to have access to various administrative and operational files, including:

• Financial records
• Budget reports
• Operational documents
• Administrative documents

Beyond these categories, the group claims the dataset includes specific items such as invoices, financial statements, mining site maps, and folder structures that appear to be related to Human Resources (HR).

About Cormidom

Cormidom, formally known as Corporación Minera Dominicana, is a mining company that operates within the Dominican Republic. The organization focuses on the operation of an underground mine, with its primary production focus being the extraction of copper and zinc.

Analysis and potential impact

The exposure of this data could lead to the disclosure of the organization's trade secrets and sensitive operational plans. Because the leaked information includes financial documents, there are secondary risks for the organization's supply chain and its various business partners. The exposure of financial and administrative data can create significant vulnerabilities for all entities involved in the company's commercial ecosystem.

From a regulatory perspective, this incident could place pressure on the organization regarding its compliance with the laws and regulations of the Dominican Republic. Furthermore, if the leaked data contains personal information belonging to employees, it increases the risk of identity theft for those individuals.

RansomHub is a Ransomware-as-a-Service (RaaS) group that first emerged in early 2024. It gained notoriety for absorbing various affiliates following the incident involving the ALPHV group. Although there were reports suggesting that RansomHub's operations might have ceased in early 2025, this recent announcement may represent the aftermath of previous attacks or a continuation of their activities.

In general, organizations facing such threats often implement defensive measures such as multi-factor authentication, regular data backups, and enhanced monitoring of network traffic. However, when a breach has already occurred, the focus often shifts to incident response and assessing the breadth of the data exposure to mitigate further damage to reputation and operations.