RansomHub ransomware group lists www.damcapital.in on its leak site

• Ransomware group: RansomHub
• Country: India
• Sector: Financial Services
• Announcement date: November 21, 2024

RansomHub claims data breach at Dam Capital Advisors Limited

The RansomHub ransomware group has listed the Indian investment bank, Dam Capital Advisors Limited, on its dedicated leak site. According to the announcement made by the threat actor group, the organization has been targeted in a cyberattack resulting in a data leak. This development follows a pattern of double extortion tactics often employed by modern ransomware groups, where stolen information is used as leverage against the victim.

Details of the alleged attack

The RansomHub group announced on November 21, 2024, that it has leaked data belonging to Dam Capital Advisors Limited. Based on the group's claims, the incident involves the unauthorized access and exfiltration of data from the institution's networks. The group asserts that they gained access to the organization's internal systems and successfully extracted various files.

The timeline provided by the group suggests the alleged attack occurred around November 16, 2024. The leaked information is claimed to include various files that belong to the institution's internal correspondence and its financial operations. While the group has published screenshots to support their claims, no specific information was provided regarding the total size of the data stolen or the specific amount of files exfiltrated. Furthermore, no ransom demand has been disclosed in the public announcement.

Scope of the leaked data

The information released by the threat actors appears to be highly sensitive, given the nature of the target organization. Screenshots provided by the group indicate that the stolen data contains a wide variety of critical documentation. The types of data identified in the leak include:

• Financial documents
• Tax records
• Bank account details
• KYC documents
• Credit card information
• Accounting files

The presence of such diverse datasets, ranging from tax records to credit card information, highlights the potential severity of the breach for the affected institution and its stakeholders.

About Dam Capital Advisors Limited

Dam Capital Advisors Limited is an India-based investment banking and financial services firm. The company provides a range of professional services, including corporate finance, capital markets, and institutional equities.

Potential risks and security implications

This leak may pose significant risks, such as identity theft or fraud, for the customers and employees of the institution. The disclosure of sensitive financial data can lead to substantial reputational damage and may trigger investigations by regulatory bodies. Because the institution operates within the financial sector, there is a high probability that the leaked data could be utilized by malicious actors for secondary attacks or highly targeted phishing campaigns.

RansomHub is a ransomware structure that emerged in early 2024 and has been noted to operate following the activities of ALPHV. In the current threat landscape, ransomware leak sites serve as a platform for these groups to pressure victims by publicly exposing stolen data. When organizations face such threats, common defensive steps often include implementing multi-factor authentication, maintaining offline backups, and conducting regular network monitoring to detect unauthorized access early. For firms in the financial sector, the exposure of KYC and banking details necessitates rigorous incident response protocols to mitigate the impact on client trust and regulatory compliance.