RansomHub ransomware group lists www.itlindia.com on its leak site

• Ransomware group: RansomHub
• Country: India
• Sector: Manufacturing
• Announcement date: November 25, 2024

RansomHub claims data breach against IntraSoft Technologies Limited

The RansomHub ransomware group has published a listing on its dedicated leak site, claiming to have stolen data belonging to IntraSoft Technologies Limited. This announcement, made on November 25, 2024, follows a pattern of double extortion commonly utilized by modern ransomware operations, where threat actors not only encrypt an organization's systems but also threaten to release sensitive information to pressure victims into paying a ransom.

According to the claims made by the threat actor, the group successfully gained unauthorized access to the organization's internal systems. The group asserts that this access allowed them to obtain various documents, which have since been publicized through the group's official leak portal. While the group has published these claims, the incident remains an allegation made by the ransomware group via their leak site.

Details of the allegedly stolen data

The information released by the group includes various types of sensitive documentation. Based on screenshots provided by the threat actor, the leaked content appears to consist of several categories of corporate and personal information. The specific data types identified in the leak include:

• Customer lists
• Invoice information
• Recruitment procedures
• Employee salary and compensation data

The exposure of such diverse datasets—ranging from commercial transaction details to internal human resources documentation—represents a significant breach of confidentiality. In many ransomware scenarios, the release of such data serves as a method of public shaming or as a tool to increase the pressure on the victim organization during negotiations.

About IntraSoft Technologies Limited

IntraSoft Technologies Limited is an India-based industrial machinery manufacturer. The company specializes in the production and supply of band saw machines, pipe processing machinery, and various other industrial cutting solutions. As an entity operating within the manufacturing sector, the company relies on various internal processes and client relationships to maintain its industrial operations.

Risk assessment and implications

The allegedly leaked data poses multifaceted risks to the organization's ongoing business operations and the personal information of its employees. The exposure of employee salary and compensation structures is particularly sensitive, as it could lead to internal organizational issues or provide malicious actors with the necessary intelligence to facilitate highly targeted phishing attacks against staff members.

Furthermore, the publication of customer lists and invoice details increases the risk of secondary attacks. Malicious actors often use stolen invoice information to conduct business email compromise (BEC) or other fraudulent activities against a company's third-party business partners. Additionally, the organization may face significant legal obligations and regulatory scrutiny under Indian data protection regulations following such a disclosure.

It is worth noting the context regarding the threat actor; the RansomHub group emerged in early 2024 and reportedly ceased operations in early 2025. This timeline suggests that even though the group may have ceased active operations, the data they hold may continue to circulate across various platforms and dark web forums following the initial leak.

For organizations in the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of unauthorized access and subsequent data exfiltration.