RansomHub ransomware group lists www.suvacity.org on its leak site

• Ransomware group: RansomHub
• Country: Fiji
• Sector: Government & Defense
• Announcement date: August 30, 2024

The official website of Suva City, the capital of Fiji, has been listed on the leak site of the RansomHub ransomware group. The group claims to have compromised data belonging to the suvacity.org domain and has published it on their leak site. This announcement, made on August 30, 2024, follows a claimed attack date of August 21, 2024.

The ransomware group claims a breach

The RansomHub group claims to have compromised data belonging to the www.suvacity.org domain. According to the group's listing, they have published numerous sample files that are alleged to belong to the institution's administrative and financial processes. The listing includes a significant amount of data, with the group claiming a file count of 36,654 files.

RansomHub is identified as a Ransomware-as-a-Service (RaaS) structure that emerged in early 2024. Reports indicate that the group has recruited former members of the ALPHV group. Such RaaS models typically operate by providing specialized ransomware software to affiliates who carry out the actual attacks, allowing the core developers to focus on maintaining the infrastructure while the affiliates handle the exploitation and negotiation.

Data involved in the alleged leak

The information shared by the group includes screenshots that allegedly contain both corporate and personal data. The leaked content is said to include various sensitive documents related to the institution's internal operations. Specifically, the group claims the following types of data are involved:

• Budget reports
• Personnel correspondence
• Insurance documents
• Payment receipts
• Event registration forms

While the group has provided these samples, no information was given regarding the total size of the stolen data or the specific ransom demand.

About Suva City

Suva City is the capital of Fiji. The organization is the official municipal body responsible for managing city services, local governance, public safety, and events related to the city.

Potential impact and risks

This breach may lead to the exposure of personal data belonging to employees and citizens within the institution. The leaked financial documents and correspondence could facilitate targeted phishing attacks against the institution's operational processes. Such attacks often leverage stolen information to build trust with victims, making fraudulent communications appear legitimate.

Furthermore, the use of leaked data in double extortion schemes could create additional pressure on the institution. Double extortion is a common tactic in modern ransomware attacks where the threat actor not only encrypts the victim's data but also threatens to leak it publicly to coerce payment. Given the group's past activities, there is a risk that such data could be utilized for secondary attacks.

The incident may also result in disruptions in compliance with data protection regulations in Fiji and could lead to significant reputational damage for the institution. Organizations in the government and defense sector often face high-stakes risks during such incidents due to the sensitive nature of the public data they manage. To mitigate such risks, organizations typically focus on robust data protection, regular security audits, and comprehensive incident response plans to address both the technical and regulatory implications of a breach.