RansomHub ransomware group lists www.eucatex.com.br on its leak site

• Ransomware group: RansomHub
• Country: Brazil
• Sector: Manufacturing
• Announcement date: June 4, 2024

RansomHub claims responsibility for Eucatex data theft

The ransomware group RansomHub has issued an announcement on its leak site claiming to have successfully exfiltrated a significant amount of data belonging to the organization www.eucatex.com.br. According to the threat actor, the stolen information exceeds 150 GB in size. This claim follows a period of alleged unauthorized access that the group suggests began around May 14, 2024.

The group's announcement, published on June 4, 2024, indicates a failed attempt at extortion. RansomHub stated that negotiations with the target entity were unsuccessful. Furthermore, the threat actor noted that the organization has denied the occurrence of any data breach. Despite this denial, the group maintains that they possess sensitive information and has announced that the stolen data is now being offered for sale on the dark web.

Ransomware attacks often involve a technique known as double extortion. In these scenarios, attackers do not merely encrypt a victim's files to disrupt operations; they also steal sensitive data prior to encryption. The goal is to pressure the organization into paying a ransom by threatening to leak the stolen information publicly, which can lead to severe reputational damage, legal consequences, and loss of competitive advantage.

Details of the alleged data exfiltration

The information claimed to be stolen by RansomHub is highly sensitive, appearing to originate from core business management systems. The group specifically claims to have accessed data from the entity's Enterprise Resource Planning (ERP) and Customer Relationship Management (CRM) systems. The exposure of such systems is particularly critical as they serve as the central repositories for a company's operational and client-facing data.

The specific types of data the group claims to possess include:

• Client data
• Contractor data
• Financial documents
• Non-disclosure agreements
• Application source codes
• ERP data
• CRM data

The presence of application source codes in a leak is especially damaging, as it can provide attackers with a roadmap for finding further vulnerabilities within the organization's software infrastructure.

Risk assessment and potential consequences

The alleged breach of Eucatex carries significant risks for the organization and its various stakeholders. For the entity's clients and business partners, the exposure of personal and professional information creates secondary risks, such as the potential for identity theft and the execution of highly targeted phishing attacks. These attacks often leverage the stolen context to appear legitimate, increasing the likelihood of success.

From a business perspective, the loss of data from ERP and CRM systems can result in the loss of trade secrets, which may weaken the company's competitive advantage in the manufacturing sector. Furthermore, because the organization operates in Brazil, it is subject to the General Data Protection Law (LGPD). This regulatory framework imposes strict obligations on how personal data must be protected, and failure to comply can lead to significant administrative sanctions.

RansomHub is identified as a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. The group reportedly gained notoriety by recruiting former affiliates from the ALPHV group. While reports suggest that RansomHub ceased its primary operations in early 2025, the existence of leaked data remains a persistent threat. The availability of such data on the market increases the likelihood that it will be exploited by various other threat actors for malicious purposes.

To defend against such threats, organizations in the manufacturing sector should implement robust security measures. These include maintaining strict access controls for ERP and CRM systems, implementing multi-factor authentication (MFA) across all entry points, and ensuring regular, encrypted backups are stored offline. Continuous monitoring of network traffic can also help detect the large-scale data exfiltration required for such breaches to occur.