RansomHub ransomware group lists www.schneider.ch on its leak site

• Ransomware group: RansomHub
• Country: Switzerland
• Sector: Professional Services
• Announcement date: September 2, 2024

RansomHub claims data leak at Schneider Schreibgeräte AG

The ransomware group known as RansomHub has issued a claim regarding a data breach involving the Swiss organization Schneider Schreibgeräte AG. According to an announcement posted on a leak site on September 2, 2024, the group alleges that they have successfully exfiltrated data from the company's infrastructure. The threat actor is reportedly employing extortion tactics to pressure the organization, stating that all stolen data will be published if their demands are not met within a two-day timeframe.

The group's claim suggests that the initial intrusion or the compromise of data occurred around August 18, 2024. While the group has posted an announcement regarding the breach, they have not provided specific details regarding the total size of the data stolen or the specific number of files involved. Furthermore, no specific ransom demand has been publicly disclosed by the group in the provided announcement.

Details of the alleged data theft

The threat actor has provided evidence in the form of screenshots to support their claims. These images appear to display a directory of various PDF files that were allegedly stolen from the organization's systems. The filenames identified in these screenshots suggest that the breach involves sensitive internal and personnel-related documentation. Based on the file names, the information potentially includes:

• Payroll records
• Employment certificates
• Process documentation

The presence of such files indicates that the breach may have targeted administrative and human resources departments. In many ransomware scenarios, particularly those involving double extortion, attackers focus on sensitive documents that contain personal information to increase their leverage during negotiations. Double extortion is a common tactic where, after encrypting a victim's systems, the attackers threaten to release the stolen data on public leak sites to force payment.

About Schneider Schreibgeräte AG

Schneider Schreibgeräte AG is a company based in Switzerland that operates within the professional services sector. The organization specializes in the production of high-quality writing instruments. Their product line is focused on pens, markers, and various other writing tools, with a specific emphasis on ergonomic design and sustainability in their manufacturing and product development processes.

Potential impact and organizational risks

The nature of the data allegedly leaked poses significant risks to the individuals whose information is contained within the files. Specifically, the exposure of payroll records and employment certificates could potentially lead to identity theft or make employees targets for highly specific, or targeted, phishing attacks. When sensitive personal and financial information is leaked, the risk of secondary extortion—where attackers target the employees directly—increases significantly.

From a regulatory perspective, the loss of such data may have implications under Swiss data protection laws, as the company is responsible for safeguarding the privacy of its employees and business processes. The leak of process documentation also presents operational risks, as it may expose internal workflows and proprietary methodologies to competitors or other malicious actors.

For organizations operating in the professional services and manufacturing sectors, such incidents highlight the importance of robust data protection frameworks. Common defensive measures against these types of threats include implementing strict access controls to sensitive directories, maintaining offline backups, and conducting regular security awareness training to help employees recognize phishing attempts. Additionally, monitoring for unauthorized data exfiltration and maintaining a comprehensive incident response plan are critical steps for mitigating the impact of a potential breach.