RansomHub ransomware group lists www.witheyaddison.com on its leak site

• Ransomware group: RansomHub
• Country: Canada
• Sector: Financial Services
• Announcement date: February 21, 2025

RansomHub claims breach of Withey Addison

The RansomHub ransomware group has listed the Canadian financial services firm Withey Addison on its dedicated leak site. According to the announcement made on February 21, 2025, the threat actor group claims to have successfully compromised the systems of the organization. This listing follows an alleged intrusion date of February 15, 2025. While the group has posted the organization's name on its platform, no information was provided regarding the specific ransom demand or the total size of the stolen data.

The group alleges that it has obtained a significant volume of files through this compromise. Specifically, the announcement claims that 105,268 files have been accessed. The group asserts that these files include various financial documents and information pertaining to the firm's internal operations and its client base. The listing includes numerous file directories that are said to contain sensitive information related to the firm's operational processes and client data.

Details of the alleged data leak

The information released by the RansomHub group includes screenshots that purportedly show a wide array of sensitive documentation. The content of these screenshots suggests that the breach involves highly confidential materials used in professional accounting and financial advisory services. The leaked data is said to include the following types of information:

• Client names
• Financial statements
• Tax return documents
• Employee confidentiality agreements
• Accounting records

The presence of such diverse documentation suggests a deep level of access into the organization's file systems. The types of data identified in the leak are highly sensitive, as they involve both personal identifiable information of clients and internal corporate documentation regarding employees and financial management.

About Withey Addison

Withey Addison is a Canadian-based accounting and financial advisory firm. The company provides professional services to individual and corporate clients in various specialized areas. Their service portfolio includes tax planning, auditing, and financial management, making them a repository for highly sensitive financial and personal information for their clientele.

Impact and security implications

The disclosure of the allegedly leaked data carries significant risks for both the firm's clients and its employees. The nature of the documents—including tax returns and financial statements—may increase the risk of identity theft and fraud for the individuals involved. Furthermore, the exposure of employee confidentiality agreements and accounting records poses a risk to the internal privacy and operational security of the firm.

Because the firm operates within Canada, this incident may trigger legal obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how organizations must handle data breach notifications. The potential consequences for the firm include long-term loss of trust from clients and significant commercial reputational damage due to the exposure of financial data. Additionally, there is a possibility that the leaked documents could be utilized by malicious actors in targeted phishing attacks against the firm or its clients.

Given the historical activities of the RansomHub group, it is assessed that the group may have employed double-extortion tactics. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to leak it publicly if a ransom is not paid. This tactic significantly increases the pressure on the victim organization.

For organizations operating in the financial services sector, maintaining robust cybersecurity defenses is critical. Common defensive strategies include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits. Additionally, organizations must be prepared to follow regulatory notification requirements and implement incident response plans to mitigate the impact of potential data exfiltration and subsequent phishing attempts.