SIAED.it targeted by RansomHub in massive data leak claim

• Ransomware group: RansomHub
• Country: Italy
• Sector: Technology
• Announcement date: June 4, 2024

RansomHub claims data breach at SIAED.it

The RansomHub ransomware group has officially listed the Italian technology company SIAED.it on its leak site, claiming to have compromised a massive volume of sensitive information. According to the announcement made on June 4, 2024, the threat actor group alleges that the breach occurred on May 23, 2024. The group claims to have exfiltrated approximately 1.6 TB of data, consisting of roughly 3,840,304 files.

Ransomware leak sites serve as a primary tool for extortion in modern cyberattacks. These platforms are used by threat actors to host announcements and proof of theft to pressure victims into paying ransoms. When an organization refuses to negotiate, groups often use these sites to threaten the public release of stolen information, a tactic known as double extortion. In this method, attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage, threatening to leak it if the ransom is not met.

Details of the alleged theft

The RansomHub group has issued a leak announcement claiming that data belonging to SIAED.it has been compromised. The group alleges that the company provides specialized services to the banking sector, making the stolen information particularly sensitive. According to the group's claims, the company has not engaged in negotiations regarding the incident, prompting the threat actors to threaten the publication of the stolen datasets.

The screenshots provided by the group as evidence of the breach suggest a wide range of compromised information. The data reportedly includes:

• Source code
• Databases
• Internal corporate information
• Billing information
• Customer information
• Bank transfer forms
• Identity documents
• Passport details
• Driver's license details

The presence of such diverse data types—ranging from technical assets like source code to highly sensitive personal identification documents—indicates a significant breach of both corporate and individual privacy if the claims are verified.

Potential risks and sector implications

The implications of this alleged breach are significant due to the nature of the data and the company's client base. If the claims made by RansomHub are verified, the leaked data could lead to severe consequences for both the company and its stakeholders. For the customers and employees of SIAED.it, the theft of identity documents, passports, and driver's licenses creates a high risk of identity theft and targeted phishing attacks. Attackers can use these specific details to craft highly convincing social engineering campaigns.

Furthermore, since SIAED.it is based in Italy, the alleged leak of personal data may fall under the scope of the General Data Protection Regulation (GDPR). This could result in the company facing significant legal obligations and scrutiny from regulatory bodies. The company's role in providing services to the banking sector also introduces secondary risks through the supply chain. When a technology provider serving financial institutions is compromised, it can create a ripple effect that threatens the security of the entire ecosystem.

RansomHub, which emerged in early 2024, is recognized as a Ransomware-as-a-Service (RaaS) group that began operating in the post-ALPHV period. Organizations in the technology and financial services sectors are encouraged to maintain robust security postures, including strict access controls, regular audits of third-party connections, and comprehensive monitoring to mitigate the risks of supply chain attacks and data exfiltration.