RansomHub ransomware group lists www.icp.pr.gov on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Government & Defense
• Announcement date: October 17, 2024

RansomHub claims to have leaked data from the Instituto de Cultura Puertorriqueña

The ransomware group known as RansomHub has published an announcement on its leak site claiming to have stolen and leaked data belonging to the Instituto de Cultura Puertorriqueña (ICP). The threat actor claims to have successfully infiltrated the systems of the organization, targeting the domain www.icp.pr.gov. According to the group's post, the breach involved the unauthorized acquisition of various documents and internal information.

The announcement was posted on the group's leak site on October 17, 2024. While the group claims to have gained access to the institution's systems, the specific date of the initial attack was cited by the threat actor as September 30, 2024. The group has shared numerous file samples to support their claims, which allegedly contain internal correspondence and operational data belonging to the organization.

Details of the alleged data theft

The information released by the threat actor includes a significant volume of files. The group claims to have obtained 144,566 files from the target. Based on the screenshots provided by the group, the leaked content appears to consist of various administrative and financial documents. The contents allegedly include:

• Budget and financial statements
• Supplier invoices
• Contract records
• Administrative correspondence

The presence of these documents suggests a deep level of access to the organization's internal processes. The group's post displays various screenshots that appear to show budget tables, payment records, and summaries of contracts, alongside various other administrative documents that facilitate the daily operations of the institution.

About the Instituto de Cultura Puertorriqueña

The Instituto de Cultura Puertorriqueña (ICP) is a government agency dedicated to preserving, promoting, and developing Puerto Rican culture. The organization manages cultural programs, supports the arts, and is responsible for the preservation of the island's historical heritage.

Risks and implications of the breach

This alleged leak may pose significant risks to the institution's operational continuity and the confidentiality of its financial data. Because the documents allegedly obtained include sensitive supplier and payment information, the breach could create secondary risks. Specifically, this information could provide a basis for targeted phishing attacks against third parties associated with the institution.

As a public institution, the breach may have legal consequences within the framework of local regulations and data protection standards. Furthermore, such an incident can lead to reputational damage for the institution and the exposure of sensitive public data. RansomHub is a known Ransomware-as-a-Service (RaaS) structure that emerged in early 2024, reportedly involving former members of the ALPHV group; the group is said to have ceased operations in early 2025.

In the broader context of cyber threats, ransomware attacks often utilize a 'double extortion' tactic. In this model, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak the data on public forums or leak sites, attackers increase the pressure on the victim to pay the ransom. This method is particularly effective against organizations that handle sensitive public or financial information, as the reputational and legal risks of a data leak often outweigh the immediate operational impact of encrypted systems.

To defend against such threats, organizations in the government and defense sectors typically implement various defensive measures. These include robust identity and access management to prevent unauthorized entry, regular monitoring of network traffic to detect anomalous behavior, and comprehensive backup strategies to ensure data can be restored. Additionally, maintaining strict adherence to data protection standards and conducting regular security audits are essential steps for mitigating the impact of potential breaches and ensuring the integrity of public data.