RansomHub ransomware group lists www.lasalle.com on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Professional Services
• Announcement date: December 4, 2024

RansomHub claims data breach against LaSalle Investment Management

The RansomHub ransomware group has listed www.lasalle.com on its leak site, claiming to possess sensitive data belonging to the organization. This announcement, made on December 4, 2024, follows a pattern of double extortion tactics often employed by modern ransomware operators. In such scenarios, threat actors do not merely encrypt an organization's systems but also exfiltrate sensitive information to use as leverage during negotiations, threatening to release the data publicly if demands are not met.

According to the group's announcement, the breach involves the unauthorized acquisition of internal documentation. To support their claims, the group has provided a link to a sample file as part of the public announcement on their leak site. This practice is frequently used by ransomware groups to demonstrate the legitimacy of their theft and to pressure the victim organization into compliance.

Details of the claimed data theft

The RansomHub group claims to hold specific categories of sensitive information belonging to the organization. Based on the announcement, the stolen data is said to include the following items:

• Cyber insurance policy
• Financial documents

The group specifically mentioned that the 2024 financial documents and the organization's cyber insurance policy are among the files they claim to possess. No specific information was provided regarding the total size of the data stolen or the exact number of files involved in the incident.

About LaSalle Investment Management

LaSalle Investment Management is an investment management firm that provides global real estate investment management services. The company manages various real estate portfolios for both institutional and individual investors, operating within the professional services sector.

Risk assessment and industry implications

This incident may lead to the exposure of the organization's financial data and insurance details to unauthorized parties. The disclosure of such information could pose significant risks to the organization's business operations and potentially weaken its competitive position in the sector. Because the organization is based in the United States, it may be subject to state-level data protection laws and regulatory scrutiny following such an exposure.

Given the past activities of the RansomHub group, it is considered that such leaks could serve as a stepping stone for identity theft or targeted phishing attacks. Even though it has been reported that the group ceased operations in early 2025, the persistence of the shared data may indicate that the risk remains ongoing for the affected organization.

For organizations operating in the professional services and investment management sectors, such incidents highlight the critical importance of robust data protection frameworks. Defensive strategies typically include implementing strict access controls, maintaining comprehensive logging to detect unauthorized exfiltration, and ensuring that sensitive financial and insurance documentation is encrypted both at rest and in transit. Furthermore, organizations often focus on employee training to mitigate the risk of phishing, which remains a primary vector for initial access in many ransomware campaigns.