RansomHub ransomware group lists www.merchant.id on its leak site

• Ransomware group: RansomHub
• Country: Indonesia
• Sector: Financial Services
• Announcement date: June 4, 2024

The ransomware group known as RansomHub has claimed to have compromised confidential data belonging to the organization merchant.id. According to a listing on the group's leak site, the threat actor alleges that they have successfully infiltrated the entity and obtained sensitive information.

Details of the alleged attack

The incident involving merchant.id was officially announced on the RansomHub leak site on June 4, 2024. While the announcement occurred in June, the group alleges that the actual attack took place much earlier, specifically on March 6, 2024. This significant time gap between the initial compromise and the public listing is a common occurrence in modern cyber extortion campaigns.

RansomHub has stated that they intend to release the stolen information in stages if their ransom demands are not met. This tactic is a hallmark of double extortion, a strategy where cybercriminals not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak data incrementally, attackers aim to increase pressure on the victim to pay the ransom to prevent further exposure.

Data involved in the claim

Regarding the specific nature of the stolen information, the group has not provided any specific details or samples. The listing does not provide information regarding the volume of data stolen or the total number of files involved. Furthermore, the group has not disclosed the amount of the ransom demand. The listing names no specific data types.

Risk assessment and implications

This incident poses a significant risk of exposure for financial or personal information belonging to the organization's customers. The potential publication of such data could lead to substantial reputational damage for the institution and may result in sanctions under relevant local data protection regulations. Given the nature of the financial services sector, the impact of such a breach can extend beyond the immediate organization.

Based on the historical activities of the RansomHub group, it is assessed that the leaked data could be utilized by malicious actors for identity theft or targeted phishing attacks. Such secondary risks are a major concern for organizations, as the stolen data can be sold on illicit markets or used to facilitate further attacks against the organization's clients or its supply chain. Furthermore, the incident may cause disruptions to the organization's operational processes and create secondary risks for its supply chain partners.

About the threat actor

RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. The group reportedly gained notoriety by attracting affiliates from the ALPHV group. While the group was active during this period, it is said to have ceased operations in early 2025.

Defensive considerations for the sector

For organizations operating within the financial services sector, incidents of this nature highlight the necessity of robust cybersecurity frameworks. To mitigate the risks associated with ransomware and data exfiltration, organizations typically focus on several defensive layers. Implementing strong access controls and multi-factor authentication can help prevent unauthorized entry into sensitive networks.

Regularly updating and patching software is essential to close vulnerabilities that threat actors often exploit. Additionally, maintaining comprehensive, offline backups is a critical component of a recovery strategy, ensuring that an organization can restore operations without necessarily complying with ransom demands. Monitoring network traffic for unusual patterns can also provide early warning signs of a potential breach. As ransomware groups continue to evolve, staying informed about threat actor trends and implementing a defense-in-depth strategy remains a priority for protecting sensitive customer information and maintaining operational integrity.