SBM & Co listed on Ransomhub leak site

• Ransomware group: Ransomhub
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: March 13, 2024

Ransomhub claims data breach against SBM & Co

The professional services firm SBM & Co has been listed on the leak site of the Ransomhub ransomware group. According to the announcement made on March 13, 2024, the threat actor group claims to have successfully breached the organization's networks and exfiltrated a significant volume of sensitive information.

The Ransomhub group alleges that they have obtained approximately 200 GB of data belonging to SBM & Co. The group has stated that the stolen information will be released to the public if the institution fails to meet their specific ransom demands. No specific ransom amount has been disclosed in the announcement.

Details of the alleged data theft

The threat actors have provided screenshots as evidence of the breach. These images reportedly contain a variety of sensitive documents and credentials that could pose a significant risk to the organization and its clients. The data mentioned in the leak includes several categories of highly confidential information.

The following types of data are allegedly included in the breach:

• Passport copies
• Tax submission reports
• Client contact information
• Invoices
• Usernames and passwords
• Internal accident reports

The presence of such diverse data types, ranging from identity documents to financial records and authentication credentials, highlights the potential impact of the intrusion on the firm's operations and client confidentiality.

About SBM & Co

SBM & Co is an accounting and business consultancy firm based in London. The company provides professional services to its clients, including auditing, tax planning, and financial advisory. As a firm handling sensitive financial and personal data for various clients, the security of its digital infrastructure is critical to its service delivery and regulatory compliance.

Risk assessment and implications

The nature of the allegedly leaked data may increase the risk of identity theft and fraud for both the employees and the clients of the firm. Given that the institution is based in the United Kingdom, the incident may be considered a data protection breach under the UK GDPR. Such breaches often require organizations to undergo rigorous investigation and reporting processes to comply with regional privacy laws.

The Ransomhub group has reportedly been associated with ALPHV affiliates in the past. This association suggests that the group may employ double-extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt the victim's data to disrupt operations but also steal sensitive information to use as leverage, threatening to leak it publicly unless a ransom is paid.

Furthermore, the breach could lead to targeted phishing attacks against the firm's clients, which could negatively impact supply chain security. When a service provider is compromised, the attackers often use the stolen contact information and invoice details to launch highly convincing social engineering campaigns against the provider's customer base.

It is also worth noting that reports regarding the cessation of Ransomhub's activities in early 2025 may indicate potential shifts in the group's operational processes. Organizations should remain vigilant against evolving tactics used by such groups. To mitigate these risks, companies in the professional services sector typically focus on strengthening network security, implementing multi-factor authentication, and conducting regular employee training to recognize phishing attempts.