RocSearch listed on Hunters leak site by threat actor group

• Ransomware group: Hunters
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: January 11, 2025

Hunters group claims data breach at RocSearch

The threat actor known as Hunters International has listed the professional services firm RocSearch on its leak site, alleging that a significant data breach has occurred. According to the announcement made on January 11, 2025, the group claims to have successfully exfiltrated data belonging to the organization. This development follows a growing trend in the cyber threat landscape where ransomware groups shift their operational focus toward pure extortion through data theft.

In many modern cyberattacks, threat actors utilize a strategy known as double extortion. In this scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also focus on stealing sensitive information. Once the data is exfiltrated, the attackers threaten to release it publicly unless a ransom is paid. This method places immense pressure on organizations, as the threat of exposing confidential information can cause long-term damage even if the company can restore its systems from backups.

Details of the alleged exfiltration

The announcement by Hunters International provides specific metrics regarding the volume of the alleged theft. The threat actor claims that the operation resulted in the exfiltration of 464.5 GB of data. This stolen information is said to consist of 53,617 files. Notably, the group has stated that the data was not encrypted during the attack, but was instead successfully exfiltrated from the organization's environment.

Despite the specific numbers provided regarding the scale of the breach, the listing does not provide specific details regarding the nature of the exfiltrated data. The information available from the group's announcement is limited to the total data volume and the total file count. The listing names no specific data types or categories of information that were allegedly stolen.

About RocSearch

RocSearch is a talent acquisition and recruitment consultancy firm that operates on a global scale. The organization specializes in finding talent for technology, digital, and business transformation roles. Their professional services are primarily focused on providing recruitment solutions for specialist-level positions and executive-level roles.

Potential impact and organizational risks

The alleged data breach at RocSearch may cause significant damage to the organization's operational processes and its commercial reputation. Because the organization is based in the United Kingdom, the confirmation of such a breach could lead to various legal obligations and the potential for administrative fines under the UK GDPR framework. Regulatory compliance is a critical concern for firms handling sensitive professional data, as data protection laws impose strict requirements on how personal information must be secured and reported.

The claims made by Hunters International suggest a strategic shift in their methodology. The group has stated that they have ceased encryption activities as of 2025, which suggests that they may now be focusing solely on data exfiltration and extortion strategies. This shift toward pure data theft increases secondary risks for the target organization, including the possibility of identity theft or highly targeted phishing attacks directed at the organization's employees and clients.

To defend against such threats, organizations in the professional services sector often implement various defensive measures. These include robust data loss prevention (DLP) tools to monitor and block unauthorized transfers of sensitive information, multi-factor authentication (MFA) to secure access to corporate environments, and comprehensive employee training to recognize phishing attempts. Additionally, maintaining strict network segmentation and monitoring for unusual data egress patterns can help detect exfiltration attempts before large volumes of data are moved out of the network.