RansomHub ransomware group lists www.crezit.com on its leak site

• Ransomware group: RansomHub
• Country: Kenya
• Sector: Financial Services
• Announcement date: June 5, 2024

RansomHub claims compromise of crezit.com

The RansomHub ransomware group has announced a data breach involving the financial services entity crezit.com. According to a post made on their leak site on June 5, 2024, the threat actors claim to have successfully compromised the internal systems of the organization and encrypted their data. The group alleges that the initial intrusion occurred around May 10, 2024.

The threat actors state that they attempted to establish communication with the administrators of crezit.com to resolve the matter. However, the group claims these attempts were unsuccessful, which has led to the public threat of releasing the stolen information. This escalation is a common tactic used by ransomware groups to pressure victims into meeting their demands.

Details of the alleged data exfiltration

The RansomHub group claims to have exfiltrated a variety of sensitive files from the organization's environment. According to the group's announcement, the stolen data includes Outlook backups and various forms of sensitive customer information. The group provided samples to support their claims, which reportedly include notarized sales contracts, Spanish national identity cards (DNI), and financial cooperation agreements.

The specific types of data mentioned in the leak include:

• Customer identity information
• Notary documents
• Financial contracts
• Outlook backups

No specific information was provided regarding the total size of the data stolen or the total number of files involved. Additionally, the group has not disclosed a specific ransom demand for the return of the data or the decryption of the systems.

Implications and risk assessment

The exposure of this data poses significant risks to the customers of crezit.com, particularly regarding the potential for identity theft and fraud. Because the leaked samples include Spanish national identity cards, the incident may lead to data protection violations and administrative penalties under the General Data Protection Regulation (GDPR). The presence of such sensitive documentation suggests a high level of risk for the individuals whose information was compromised.

RansomHub has been associated with former affiliates of the ALPHV ransomware group. This connection suggests that the group likely employs double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage, threatening to leak it publicly if the ransom is not paid. This method significantly increases the pressure on the victim organization.

Given that the target operates within the financial services sector, the stolen data could potentially be utilized by threat actors for secondary attacks or highly targeted phishing campaigns. Such incidents often result in substantial reputational damage and complex legal consequences for the organization involved. To mitigate such risks, organizations in the financial sector typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent initial access through phishing.