Rapid Granulator listed on RansomHouse leak site

• Ransomware group: RansomHouse
• Country: Sweden
• Sector: Manufacturing
• Announcement date: February 23, 2024

RansomHouse claims data breach at Rapid Granulator

The RansomHouse ransomware group has listed the Swedish manufacturing company Rapid Granulator on its dedicated leak site. According to the claims made by the threat actors, the organization has been targeted in a data exfiltration attack, with the group asserting that a significant volume of data has been stolen from the company's systems.

The incident follows a pattern common in modern cyber extortion, where threat actors move beyond simply encrypting files to stealing sensitive information. This method, often referred to as double extortion, involves threatening to release stolen data on public leak sites to pressure the victim into paying a ransom. By publishing information about the breach, these groups aim to maximize the reputational damage to the target organization, thereby increasing the likelihood of a successful extortion attempt.

Details of the claimed attack

According to the announcement published by the RansomHouse group on February 23, 2024, the threat actors claim to have gained unauthorized access to the organization's systems on January 28, 2024. This indicates that the attackers may have maintained presence within the network for several weeks before the public announcement was made.

The group has stated that they successfully exfiltrated approximately 60 GB of data from the company. In their communication, the RansomHouse group suggested that the organization should contact them to prevent the leaked data from being sold to third parties or shared with other entities. No specific ransom demand has been disclosed in the public announcement.

Data involved in the leak

While the group has provided screenshots indicating a data set of approximately 60 GB, there is no specific detail regarding the actual content of the allegedly leaked data. The listing does not provide a breakdown of file types or specific categories of information that were targeted during the intrusion.

• No specific data types were named in the listing.

About Rapid Granulator

Rapid Granulator is a Swedish-based company and a world leader in the production of plastic recycling equipment. Founded in 1942, the company develops machinery for recycling plastic waste and operates globally.

Potential impact and industry implications

This incident may pose significant risks to the organization's operational continuity and commercial reputation. Because Rapid Granulator is a Sweden-based company, if the leaked data contains personal information, legal sanctions and notification obligations under the General Data Protection Regulation (GDPR) may arise. The RansomHouse group's methodology, which focuses on data exfiltration and extortion, suggests that the disclosure of employee and customer data could lead to secondary attacks or identity theft.

Furthermore, as a firm operating in the manufacturing sector, the potential infringement of intellectual property rights could negatively impact the company's competitive advantage. In the manufacturing industry, the theft of proprietary designs, technical specifications, or manufacturing processes can be devastating to a company's market position.

To defend against such threats, organizations in the manufacturing sector can implement several defensive steps. These include robust network segmentation to prevent lateral movement, strict access controls to limit the exposure of sensitive data, and continuous monitoring of data egress to detect large-scale exfiltration attempts. Additionally, maintaining comprehensive offline backups and conducting regular incident response drills can help mitigate the impact of both encryption and extortion-based attacks.