RansomHub ransomware group lists www.rotaryeng.co.th on its leak site

• Ransomware group: RansomHub
• Country: Thailand
• Sector: Manufacturing
• Announcement date: January 10, 2025

RansomHub claims responsibility for data leak involving Rotary Engineering

The RansomHub ransomware group has published a listing on its dedicated leak site, claiming that it has successfully targeted the Thailand-based manufacturing company, Rotary Engineering (www.rotaryeng.co.th). According to the announcement made on January 10, 2025, the threat actor group alleges that it has exfiltrated a significant volume of sensitive information belonging to the organization.

Ransomware attacks often involve a technique known as double extortion, where attackers not only encrypt a victim's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to release this stolen information on public leak sites, ransomware groups attempt to pressure organizations into paying a ransom to prevent the exposure of proprietary and personal information. This method increases the pressure on victims, as the loss of data can lead to regulatory penalties, loss of competitive advantage, and reputational damage.

Details of the alleged data exfiltration

The RansomHub group listed the organization on its leak site on January 10, 2025, claiming the attack occurred around December 21, 2024. The group asserts that it has stolen a large volume of files, specifically citing a count of 90,487 files. To support their claims, the attackers have shared various document samples that appear to be related to the company's internal operational and financial processes.

The shared screenshots and samples provided by the group indicate that the breach may have compromised a wide range of sensitive documentation. The specific types of data identified in the leak include:

• Financial data
• Bank account details
• Employee payrolls
• Non-disclosure agreements
• Technical project documents
• Personnel attendance records

While the group has provided these samples to demonstrate the scale of the breach, no information was provided regarding the specific ransom demand or the total size of the data exfiltrated.

About Rotary Engineering

Rotary Engineering is a Thailand-based engineering and manufacturing company. It specializes in the design, fabrication, and installation of mechanical equipment for industrial facilities.

Potential risks and industry implications

The alleged leak of this information poses significant risks to the organization. The exposure of technical project files and non-disclosure agreements could jeopardize the company's trade secrets and competitive standing in the engineering sector. Furthermore, the disclosure of financial statements and bank account details threatens the organization's financial security and could potentially facilitate fraudulent activities or unauthorized transactions.

There is also a significant risk to the personnel involved. The exposure of employee payrolls and attendance records constitutes a breach of personal information, which may lead to targeted phishing attacks against the affected employees. Such attacks often use stolen personal details to gain further access to corporate networks or to conduct identity theft.

RansomHub is a group that emerged in early 2024, reportedly operating following the dissolution of the ALPHV ransomware group. Although there have been reports suggesting the group may have ceased operations in early 2025, the presence of such leaks continues to pose lingering risks to organizations. For companies in the manufacturing and engineering sectors, maintaining strict compliance with local data protection regulations, such as those in Thailand, is essential. In the event of a breach, organizations are often required to notify affected parties and regulatory bodies to mitigate harm and ensure transparency.

To defend against such threats, organizations typically implement multi-layered security strategies. This includes robust backup solutions, strict access controls, and continuous monitoring of network traffic to detect unauthorized data movement. Regular security audits and employee training on phishing awareness are also critical components of a modern defensive posture against ransomware-driven data exfiltration.