RansomHub ransomware group lists www.mataderodegijon.es on its leak site

• Ransomware group: RansomHub
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: June 4, 2024

The ransomware group known as RansomHub has announced a cyberattack targeting the Spanish organization mataderodegijon.es. According to a post on their leak site, the group claims to have successfully encrypted the organization's servers and accessed critical industrial control systems.

Details of the claimed attack

RansomHub claims that the attack occurred on May 16, 2024, and was officially announced on their leak site on June 4, 2024. The threat actors state that they have gained unauthorized access to the SCADA (Supervisory Control and Data Acquisition) industrial control systems used by the institution's biogas plant. By accessing these systems, the group claims they were able to block operational processes.

In addition to the disruption of industrial operations, the group asserts that they have encrypted the organization's backups. This tactic is a common component of modern ransomware operations, often referred to as double extortion. In such scenarios, attackers not only encrypt the primary data to halt business operations but also target backups to eliminate the victim's ability to restore systems independently, thereby increasing the pressure to pay a ransom.

Data involved in the incident

The group claims that approximately 400 GB of data has been affected by this incident. While the group has provided screenshots as evidence, these images primarily display SCADA control panels and various system parameters related to the biogas plant. Regarding the specific content of the allegedly leaked data, the listing provides no detailed information.

• 400 GB of encrypted data

Impact and assessment

This incident poses significant risks to the operational continuity of the institution. The claim of gaining access to SCADA systems is particularly concerning, as it introduces the potential for the manipulation or complete halting of industrial processes. Such an event can lead to physical operational disruptions and safety concerns within a production environment.

Because the organization operates within Spain, this breach may trigger specific data protection obligations under the General Data Protection Regulation (GDPR). Furthermore, the claim that backups have been encrypted significantly complicates any potential data recovery efforts and may increase the pressure on the organization to comply with ransom demands.

RansomHub is identified as a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. It is reported that the group attracted various affiliates following the incident involving the ALPHV group. Currently, public information regarding the specific inner workings and members of RansomHub remains limited.

Security considerations for industrial sectors

Incidents involving the compromise of industrial control systems highlight the growing threat to critical infrastructure and specialized production sectors. When attackers target SCADA systems, the impact moves beyond data loss and into the realm of physical operational disruption. Organizations in the agriculture and food production sectors must prioritize the segmentation of their IT and OT (Operational Technology) networks to prevent lateral movement from office environments to industrial controllers.

Defensive strategies for such organizations typically include maintaining offline, immutable backups that are isolated from the main network to ensure recovery is possible even if primary backups are targeted. Additionally, implementing robust monitoring for industrial protocols and strictly controlling remote access to control panels can mitigate the risk of unauthorized manipulation of industrial processes.