RansomHub ransomware group lists www.garudafood.com on its leak site

• Ransomware group: RansomHub
• Country: Indonesia
• Sector: Agriculture and Food Production
• Announcement date: July 20, 2024

RansomHub claims to have compromised Garudafood

The ransomware group known as RansomHub has officially listed the Indonesian food and beverage manufacturer, Garudafood, on its dedicated leak site. According to the announcement made on July 20, 2024, the threat actors claim to have successfully compromised the organization's systems, leading to both the exfiltration of sensitive information and the disruption of critical operational processes.

The group alleges that its intrusion has paralyzed the organization's production systems. This claim suggests a significant impact on the company's ability to maintain its manufacturing workflows. Furthermore, the attackers assert that they have exfiltrated a portion of the company's data. The threat actor has issued a threat, stating that if the organization does not cooperate with their specific ransom demands, the captured information will be released publicly on their platform.

Details of the alleged data theft

While the specific volume of the stolen data and the exact ransom amount requested have not been disclosed in the announcement, the group has provided visual evidence to support their claims. The available information suggests that the breach involves both personal and corporate information. Based on the details provided by the threat actor, the following types of data are reportedly involved:

• Employee personal data
• Corporate product documents

The evidence presented by the group includes screenshots that appear to show lists containing names, email addresses, and various date information, which likely belong to the company's employees. Additionally, the leaked materials reportedly include corporate product documents specifically related to the 'Chocolatos' brand, highlighting a potential risk to the company's intellectual property and commercial secrets.

About Garudafood

Garudafood is a leading food and beverage manufacturer based in Indonesia. The company operates with a wide range of products including snacks, biscuits, dairy products, and confectionery. As a major player in the Indonesian food production sector, the company manages complex supply chains and large-scale manufacturing operations to distribute its diverse product portfolio.

Impact assessment and industry implications

The claims made by RansomHub could lead to significant operational disruptions for the organization and the potential exposure of sensitive employee data. Such a breach may place the organization under legal obligations regarding data protection under Indonesian regulations. Furthermore, the exposure of employee information, such as names and email addresses, creates a high risk for targeted phishing attacks, where attackers use stolen details to gain further access or deceive staff members.

Given the nature of the claims, it is assessed that the group may be employing a double-extortion strategy. In a double-extortion scenario, ransomware actors not only encrypt a victim's systems to halt operations but also steal sensitive data to use as leverage, threatening to leak it if the ransom is not paid. This method increases the pressure on organizations as they must decide between paying to restore operations or paying to prevent a data leak.

For organizations within the food and beverage sector, such breaches also pose substantial risks to the broader supply chain. A disruption in a major manufacturer's production can have cascading effects on distributors and retailers. To mitigate these risks, organizations typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining offline backups, conducting regular security audits, and training employees to recognize phishing attempts. The incident involving Garudafood highlights the ongoing threat that ransomware groups pose to critical manufacturing and production environments.