RansomHub ransomware group lists www.oma.aero on its leak site

• Ransomware group: RansomHub
• Country: Mexico
• Sector: Transportation
• Announcement date: October 24, 2024

RansomHub claims massive data exfiltration from Oma.aero

The ransomware group known as RansomHub has announced that it has allegedly exfiltrated a significant amount of data belonging to Oma.aero. According to the announcement posted on their leak site on October 24, 2024, the group claims to have gained unauthorized access to the organization's infrastructure. The breach was reportedly carried out around October 18, 2024, resulting in a massive volume of stolen information.

RansomHub claims that the volume of data compromised during this incident is approximately 3 TB. While the group has provided samples of various documents related to the organization's operational processes to support their claims, they have not provided information regarding a specific ransom demand or the total file count involved in the breach.

Details of the alleged data theft

The threat actor claims that the stolen information is highly sensitive and covers a wide range of organizational functions. According to the group, the compromised data includes various types of documentation that could impact both the company and its associates. The information allegedly includes financial documents, employee records, and agreements involving third parties.

The specific categories of data identified in the claim include:

• Financial reports
• Employee personal data
• Contact details
• Agreements
• SQL databases

Beyond these specific categories, the group also alleges that the exfiltrated content contains sales data, shareholder information, addresses, email correspondence, and credentials. This breadth of data suggests a deep intrusion into the company's internal systems and databases.

About Oma.aero

Oma.aero is an aviation company specializing in advanced aerial mobility solutions. The company maintains a particular focus on electric vertical takeoff and landing (eVTOL) aircraft. Their work centers on developing innovative aviation technologies that are aimed at making urban transportation more efficient and sustainable.

Implications and risks of the breach

The nature of the allegedly leaked data poses several significant risks. The exposure of personal data and contact details increases the risk of identity theft and targeted phishing attacks directed at employees and business partners. Furthermore, because the organization is located in Mexico, the breach may lead to legal challenges regarding compliance with relevant data protection regulations.

The leakage of third-party agreements introduces secondary risks concerning supply chain security, as sensitive contractual information is now in the hands of a threat actor. Given that RansomHub has historically employed double-extortion tactics—a method where attackers both encrypt data and threaten to leak it to pressure victims—the publication of this data could negatively impact the organization's commercial reputation.

In the broader context of cybersecurity, ransomware leak sites serve as a platform for extortion, where groups post stolen data to pressure organizations into paying ransoms. Organizations in the transportation and aviation sectors often face high-stakes threats due to the sensitive nature of their operational and financial data. To defend against such threats, organizations typically implement defensive steps such as robust multi-factor authentication, regular security audits, network segmentation, and comprehensive employee training to mitigate the risk of initial access.

Information regarding the RansomHub group remains limited in the public domain, making it difficult to ascertain the full scope of their operations or specific technical methodologies. As with any alleged breach, the impact remains dependent on the actual contents of the data and the organization's ability to secure its infrastructure against future incursions.