Ransomhub ransomware group lists www.erma-rtmo.it on its leak site

• Ransomware group: Ransomhub
• Country: Italy
• Sector: Manufacturing
• Announcement date: July 18, 2024

The Ransomhub ransomware group has listed data allegedly belonging to the Italian organization Erma R.T.M.O. on its leak site. This announcement, made on July 18, 2024, follows a claimed attack date of July 14, 2024. The threat actor claims to have successfully breached the institution's networks and exfiltrated various documents, threatening to release the information to the public if the organization fails to comply with their demands.

The details of the claimed attack

According to the announcement made by the Ransomhub group, the threat actors gained unauthorized access to the internal networks of Erma R.T.M.O. The group asserts that they have obtained a variety of sensitive documents during this intrusion. The threat actor has utilized a double extortion tactic, a common method in modern ransomware attacks where the attackers not only encrypt the victim's data but also threaten to leak the stolen information on a public leak site to increase pressure on the organization.

In such scenarios, the threat actor typically demands a ransom in exchange for not publishing the stolen data or for providing a decryption tool. While the specific ransom demand and the exact size of the data exfiltrated have not been disclosed in the announcement, the group has made it clear that the data's release is contingent upon the victim's compliance with their demands. Ransomware leak sites serve as a platform for these groups to shame their victims and demonstrate their capabilities to the public.

The types of data allegedly involved

The screenshots provided by the threat actor suggest that the stolen information includes a wide range of sensitive business and personal documents. The data allegedly leaked includes various items that could impact both the company's operations and individual privacy. The specific types of data mentioned in the leak include:

• Sales reports
• Legal correspondence
• Invoices
• Customs inspection reports
• Personal identification data

The inclusion of personal identification data, such as an image of a personal passport, highlights the sensitive nature of the breach. When personal information is compromised, it significantly increases the risk of identity theft for the individuals involved. Furthermore, the exposure of commercial and financial documents can lead to a loss of competitive advantage and cause significant disruption to the organization's operational processes.

Organization profile

Erma R.T.M.O. is an Italy-based company operating in the manufacturing sector. The organization specializes in industrial machinery, metalworking equipment, and precision machining.

Analysis and potential consequences

The alleged leak of this data carries several significant risks. For the individuals whose personal identification data was stolen, there is a heightened risk of identity theft. For the organization itself, the disclosure of commercial and financial data could lead to a loss of competitive advantage and disrupt various operational processes. Because the institution is based in Italy, this incident may likely result in legal sanctions under the EU General Data Protection Regulation (GDPR) due to the potential exposure of sensitive information.

Based on the past activities of the Ransomhub group, it is assessed that such leaks may be utilized for secondary phishing attacks, where the stolen information is used to craft highly convincing fraudulent communications to target employees or clients. It should be noted that public information regarding the Ransomhub group remains limited.

Organizations operating in the manufacturing sector can take several defensive steps to mitigate the risks associated with ransomware and data breaches. Implementing robust network segmentation can help prevent attackers from moving laterally through a network after an initial breach. Regular, offline backups are essential for recovering from encryption attacks, though they do not prevent data exfiltration. Additionally, organizations should focus on strong identity and access management (IAM) and multi-factor authentication (MFA) to secure entry points. Continuous monitoring of network traffic and implementing endpoint detection and response (EDR) solutions can also assist in identifying and responding to unauthorized access attempts before data can be exfiltrated.