RansomHub ransomware group lists www.mineduc.gob.gt on its leak site

• Ransomware group: RansomHub
• Country: Guatemala
• Sector: Government & Defense
• Announcement date: August 30, 2024

RansomHub claims breach of Guatemala's Ministry of Education

The digital assets belonging to the Ministry of Education of Guatemala (mineduc.gob.gt) have been listed on the RansomHub ransomware group's leak site. According to the announcement, the threat actor group claims to have successfully gained access to the institution's internal systems. As part of their extortion tactics, the group has published a portion of the allegedly compromised data as samples to demonstrate the validity of their claims.

The incident was officially announced on the group's leak site on August 30, 2024. The group claims that the breach occurred on the same day, August 30, 2024. According to the information provided by the attackers, the volume of the stolen data is substantial, totaling approximately 567.98 GB. This dataset is reported to consist of more than 591,138 individual files, representing a significant portion of the ministry's digital infrastructure.

Details of the claimed data theft

The screenshots provided by the RansomHub group as evidence of the breach reveal a variety of sensitive information. The leaked samples appear to include personal identification documents, specifically identified as DPI, alongside various administrative and financial records. The presence of such diverse file types suggests a broad compromise of the organization's file servers and databases.

The specific categories of data mentioned in the listing include:

• Personal identification information
• Public expenditure reports
• Accounting records
• Administrative documents

The exposure of these specific file types, particularly personal identification documents, highlights the sensitive nature of the breach. Such data is often highly valued by cybercriminals for fraudulent purposes.

About the Ministry of Education of Guatemala

The Ministry of Education of Guatemala is the official government body responsible for managing the country's educational policies, programs, and services. It serves as a central pillar of the national administration by supporting the national education system. The ministry's responsibilities include providing essential educational materials, managing administrative resources, and disseminating news updates to students, teachers, and parents across the country.

Implications and organizational risks

The alleged leak of this data carries significant risks for both the institution and the individuals involved. For employees and citizens whose personal identification information may have been compromised, there is a heightened risk of identity theft. Furthermore, the availability of such documents in the hands of malicious actors could lead to individuals being targeted by highly specific and sophisticated phishing attacks.

From an institutional perspective, the exposure of public expenditure reports and accounting records may lead to administrative disruptions and a potential loss of public trust in the government body. Such incidents can also trigger complex compliance issues regarding data protection regulations within Guatemala. RansomHub, the group responsible for this claim, is known as a Ransomware-as-a-Service (RaaS) group that emerged in early 2024 and reportedly absorbed various affiliates following the ALPHV incident; the group was said to have ceased operations in early 2025.

In general, organizations in the government and defense sector face unique challenges when defending against ransomware. To mitigate such risks, it is common practice for institutions to implement multi-factor authentication, maintain offline backups, and conduct regular security awareness training for staff. Protecting sensitive citizen data requires a robust defense-in-depth strategy to prevent unauthorized access to critical administrative and personal information.