Rekamy targeted by RansomHub in alleged data breach

• Ransomware group: RansomHub
• Country: Malaysia
• Sector: Technology
• Announcement date: March 9, 2024

RansomHub claims a breach of Rekamy

The ransomware group known as RansomHub has announced that it has successfully infiltrated the networks of the Malaysian technology company Rekamy. According to an announcement made on the group's leak site on March 9, 2024, the threat actors claim to have obtained a significant amount of data during the attack. This incident follows a pattern of double extortion, a common ransomware tactic where attackers not only encrypt a victim's systems but also steal sensitive information to use as leverage for ransom demands.

The group's claim suggests that the breach is not limited to the primary target but may have wider implications for the organization's ecosystem. By targeting a technology and digital advertising provider, the attackers may be attempting to leverage a supply chain attack, aiming to reach the various clients and entities that rely on the organization's infrastructure and services.

Details of the alleged data theft

According to the claims made by RansomHub, the attackers gained access to a wide array of sensitive information hosted within Rekamy's network. The group has stated that they have obtained 42GB of data. The threat actor has indicated that they will proceed to leak all files and databases containing personally identifiable information (PII) if their demands are not met. While the specific ransom amount has not been disclosed, the group has made it clear that the release of stolen data is their primary method of pressure.

The data allegedly compromised in this incident includes several critical categories of information. Based on the group's claims, the following types of data are at risk:

• Customer information
• Payment records
• Personally identifiable information (PII)
• Corporate documents

The breach potentially extends beyond Rekamy itself. The announcement suggests that data belonging to various companies hosted within the network may also be at risk. Specifically, the group mentioned that companies such as AgroBazaar, Panorama LangKawi, Eskayvie, ArtClean, Aito, and Opisku may have their information compromised as a result of this intrusion.

About Rekamy

Rekamy is a digital advertising and technology company based in Malaysia. The company provides performance-based advertising solutions and digital marketing services for brands. As a provider of digital marketing and technology services, the company manages various datasets and client information essential for its advertising operations.

Potential impact and security implications

This incident may pose significant risks of identity theft and fraud for Rekamy and the customers of the companies it hosts. The sensitive nature of the compromised data, which includes payment records and personally identifiable information, could lead to legal obligations under the Malaysian Personal Data Protection Act (PDPA). The potential for secondary attacks is high; given the past activities of the RansomHub group, it is possible that the obtained data may be utilized for targeted phishing campaigns or further malicious activities against the affected entities.

The impact of this incident highlights the risks associated with supply chain vulnerabilities. When a technology provider is compromised, the hosted companies may face similar security risks, creating a ripple effect throughout the digital ecosystem. RansomHub, which reportedly emerged in early 2024 and has ties to ALPHV, appears to have a tendency to publish data if the ransom is not paid, making rapid response and data protection critical.

To mitigate such risks, organizations in the technology and digital services sector should prioritize robust security frameworks. This includes implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized network access, and ensuring that data is encrypted both at rest and in transit. Regular security audits and vulnerability assessments are also essential to identify weaknesses before they can be exploited by threat actors. Furthermore, organizations should have a clear incident response plan to manage the complexities of a data breach and comply with regional data protection regulations.