RansomHub ransomware group lists www.hashem-contracting.com on its leak site

• Ransomware group: RansomHub
• Country: Saudi Arabia
• Sector: Professional Services
• Announcement date: December 13, 2024

The RansomHub ransomware group has claimed responsibility for a data breach involving the Saudi Arabian organization Hashem Contracting. According to an announcement made on the group's leak site, the threat actor alleges to have successfully exfiltrated a significant volume of sensitive information from the company's network.

Details of the alleged attack

The threat actor known as RansomHub listed data allegedly belonging to Hashem Contracting on its leak site on December 13, 2024. The group claims to have gained unauthorized access to the organization's network and obtained approximately 97 GB of data, consisting of 16,032 files. The breach is reported to have occurred around December 7, 2024.

Based on the patterns observed in such cyberattacks, the group appears to be employing a double extortion tactic. This method involves not only encrypting an organization's systems to disrupt operations but also stealing sensitive data to use as leverage. By threatening to publish or sell the exfiltrated information on public forums, the attackers attempt to exert maximum pressure on the victim to meet their demands. In this specific instance, the group is using the threat of data exposure to target the organization.

Data types involved in the leak

The directory listings provided in the group's screenshots suggest a wide variety of stolen information. The leaked content reportedly includes various business and personal files that could be highly sensitive. The specific types of data identified in the listing include:

• ERP data
• Email files
• Product catalogues
• Scanned documents

In addition to these business-critical files, the directory listings also reportedly contain personal e-books and various media files, indicating a broad scope of the data exfiltration from the compromised environment.

About Hashem Contracting

Hashem Contracting is a construction and contracting company based in Saudi Arabia. The company provides professional services for various infrastructure and superstructure projects, making it a significant player in the regional construction sector.

Risk assessment and implications

The alleged exfiltration of corporate operational documents and potential commercial information may harm the organization's competitive advantage. Because the stolen data includes ERP information and product catalogues, the company may face challenges regarding its proprietary business processes and market positioning. Furthermore, as the organization operates in Saudi Arabia, it is expected that legal processes under relevant local data protection regulations may be triggered as a result of this incident.

The RansomHub group is a Ransomware-as-a-Service (RaaS) structure that emerged in early 2024 and reportedly absorbed affiliates after the ALPHV group. Although it has been reported that the group ceased operations in early 2025, the retrospectively published data may pose a long-term security risk for the organization's employees and business partners. Such leaks often lead to secondary risks, including targeted phishing campaigns or fraud, where attackers use the stolen information to craft highly convincing social engineering attacks against employees or clients.

For organizations in the professional services and construction sectors, such incidents highlight the necessity of robust security postures. Defensive measures typically involve implementing multi-factor authentication, maintaining rigorous patch management, and ensuring comprehensive network segmentation to prevent lateral movement by attackers. Additionally, maintaining offline, immutable backups is a critical component of a resilient recovery strategy. As these types of breaches can lead to long-term risks even after a threat actor has ceased operations, continuous monitoring and proactive data protection remain essential for mitigating the impact of exfiltrated information.