RansomHub ransomware group lists www.smarterp.com on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Technology
• Announcement date: August 26, 2024

RansomHub claims to have stolen SmartERP data

The ransomware group known as RansomHub has published a leak announcement claiming to possess a significant volume of sensitive information belonging to SmartERP. According to the post published on the group's leak site on August 26, 2024, the attackers claim to have compromised over 110,000 records. These records are alleged to belong to both customers and employees of the organization.

The group claims that the breach was made possible due to vulnerabilities within the organization's database security. According to the announcement, the attackers claim to have both encrypted and exfiltrated the data. Rather than a direct ransom negotiation being the only focus, the announcement states that the stolen data is currently being offered for sale via an auction process.

Details of the alleged data leak

The information allegedly stolen by the threat actors is highly sensitive, containing a variety of personally identifiable information (PII). Based on the screenshots provided in the group's announcement, the data includes samples of user detail tables and documents that are purported to be passport records. The specific types of data mentioned in the claim include:

• Names
• Social Security Numbers (SSN)
• Dates of birth
• Addresses
• Passport information

The presence of such high-value identity documents and government identifiers increases the potential impact of the leak, as these elements are frequently used in fraudulent activities.

About SmartERP

SmartERP is a technology solutions provider that specializes in enterprise resource planning (ERP) software. The company provides a range of services, including consulting, implementation, and support. These services are designed to help businesses optimize their internal processes and improve overall operational efficiency through specialized software solutions.

Analysis and potential risks

The sensitivity of the data allegedly leaked poses a high risk of identity theft and fraud for the individuals whose information was targeted. Because SmartERP is an organization based in the United States, this incident may trigger specific legal obligations under federal regulations as well as state-level data protection laws.

RansomHub, a group that emerged in early 2024 and reportedly ceased operations in early 2025, is known for incorporating former members of other groups, such as ALPHV. The group's history indicates a tendency to employ double-extortion tactics. In a double-extortion scenario, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage, threatening to leak the information if the ransom is not paid.

This tactic creates significant secondary risks for the victims. For example, the customers and employees of the organization may face targeted phishing attacks from threat actors using the stolen information to appear legitimate. Such attacks often aim to further compromise the victims' personal accounts or financial assets.

In the technology and software services sector, organizations often handle vast amounts of client data, making them attractive targets for sophisticated ransomware groups. To mitigate these risks, organizations typically focus on hardening database security, implementing strict access controls, and ensuring robust encryption for data at rest and in transit. Furthermore, proactive monitoring and rapid incident response capabilities are essential for identifying and containing unauthorized access before large-scale exfiltration can occur.