RansomHub ransomware group lists www.johnkellys.com on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Professional Services
• Announcement date: August 30, 2024

RansomHub claims data breach against John Kelly Chocolates

The RansomHub ransomware group has published a listing on its leak site claiming to have compromised the entity operating under the domain www.johnkellys.com. According to the announcement made on August 30, 2024, the group asserts that they have successfully exfiltrated a significant volume of data belonging to the organization.

Ransomware groups often utilize leak sites as a tool for double extortion. In this common tactic, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information. The threat actors then threaten to release this stolen data on public forums or specialized leak sites unless a ransom is paid. This method increases the pressure on the victim by threatening their reputation and legal standing.

Details of the alleged exfiltration

The RansomHub group claims that the attack took place on July 26, 2024. Through the provision of various screenshots, the group asserts that they have gained access to the entity's commercial correspondence, invoices, and logistics documentation. The announcement indicates that the dataset released by the group consists of 86,283 files.

The content revealed in the screenshots provided by the attackers suggests a wide range of corporate information was targeted. The specific types of data mentioned in the listing include:

• Commercial invoices
• Customs and logistics documents
• Supply contracts
• Sales reports
• Internal corporate correspondence

The presence of such diverse documentation suggests that the attackers targeted the administrative and operational core of the business. While the group has reportedly ceased operations in early 2025, the data they leaked may continue to pose secondary risks to the organization and its partners.

About John Kelly Chocolates

John Kelly Chocolates is a chocolate manufacturer specializing in handcrafted and gourmet chocolate creations. The company is particularly known for its truffle fudge and chocolate-dipped products. Based in Los Angeles, the company offers a range of luxury chocolate treats using high-quality ingredients.

Analysis and potential impact

The allegedly exfiltrated data may contain sensitive information regarding the entity's commercial operations, supply chain partners, and financial processes. Such a breach could potentially damage the entity's reputation among business partners and facilitate targeted phishing attacks against third parties. Because the data includes logistics and supply contracts, the breach may extend its impact beyond the company itself to its entire network of vendors and clients.

RansomHub is recognized as a Ransomware-as-a-Service (RaaS) group that emerged in early 2024, with reported ties to ALPHV. The professional nature of the attack, combined with the specific types of data targeted, suggests a highly motivated threat actor. Furthermore, given the nature of the data, compliance risks under GDPR or relevant local data protection regulations may arise for the organization.

To defend against such threats, organizations in the professional services and manufacturing sectors often implement multi-layered security strategies. This includes robust backup solutions that are stored offline to prevent encryption, and strict identity and access management to ensure that only authorized personnel can access sensitive commercial and financial documents. Monitoring for unusual data exfiltration patterns is also a critical component of a proactive defense posture.