RansomHub ransomware group lists www.nttdata.ro on its leak site

• Ransomware group: RansomHub
• Country: Romania
• Sector: Technology
• Announcement date: July 2, 2024

RansomHub claims a data breach at NTT DATA Romania

The RansomHub ransomware group has listed www.nttdata.ro on its dedicated leak site, alleging that the organization has suffered a data breach. This announcement, made on July 2, 2024, follows the group's established pattern of targeting various organizations to pressure them through the threat of public data exposure.

Ransomware leak sites serve as a platform for threat actors to host stolen information, often using a double extortion tactic. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This method increases the pressure on victims to pay ransoms to prevent the disclosure of proprietary or personal data.

Details of the alleged attack

According to the claims made by the RansomHub group, the unauthorized access to the organization's systems occurred on June 15, 2024. The threat actor added the company to their leak site several weeks after the alleged initial breach. While the group has publicly claimed responsibility for the incident, they have not provided specific details regarding the nature or the scope of the allegedly leaked data.

The listing currently provides no information regarding the volume of data stolen or the specific types of files that may have been compromised. Furthermore, no ransom demand has been publicly specified by the group in relation to this particular claim.

Organization profile

NTT DATA Romania is a technology company that operates as part of the global technology giant NTT DATA. The company specializes in providing a wide range of services, including software development, IT consulting, and digital transformation solutions. Their expertise is focused on developing customized IT solutions for various critical sectors, such as banking, automotive, and public services.

Potential impact and security considerations

This incident may pose significant risks to the organization's data privacy and its operational continuity. Because the organization operates within Romania, a successful data breach could potentially trigger legal processes under the regulations established by the EU GDPR. Such regulatory frameworks are designed to protect personal data and impose strict requirements on how organizations handle and protect information.

The RansomHub group is a relatively recent emergence, having appeared in early 2024. Reports indicate that the group has incorporated affiliates from ALPHV, which may suggest a high level of technical capability. The exposure of organizational data can lead to various secondary risks, such as identity theft or targeted phishing campaigns directed at the organization or its clients.

It is worth noting that there are reports suggesting the group ceased operations in early 2025, which may indicate that current leaks are part of a legacy archive. For organizations in the technology sector, maintaining robust defensive postures is essential. This includes implementing strong access controls, regular security audits, and comprehensive monitoring to detect unauthorized access. Organizations often rely on multi-layered security strategies to mitigate the risks of data exfiltration and ensure the integrity of their digital services.

• No data types were specified in the listing.