Skyway Coach Lines and Shuttle Services targeted by RansomHub

• Ransomware group: RansomHub
• Country: Canada
• Sector: Transportation
• Announcement date: April 8, 2024

RansomHub claims data breach at Skyway Coach Lines and Shuttle Services

The ransomware group known as RansomHub has announced on its leak site that it has successfully exfiltrated a significant amount of data from Skyway Coach Lines and Shuttle Services. According to the group's announcement, the breach involves a substantial volume of information belonging to the Canadian transportation provider.

The threat actor, RansomHub, alleges that it obtained access to the servers belonging to Skyway Coach Lines and Shuttle Services. In a post published on April 8, 2024, the group claimed to have exfiltrated 60GB of data from the organization. While the specific timing of the initial intrusion is not explicitly detailed in the announcement, the group has claimed an attack date of March 12, 2024. To support their claims, the group has shared various file samples on their leak site, which purportedly belong to the organization's operational processes and its employees.

Details of the claimed data exfiltration

The information released by the threat actor appears to include a wide range of sensitive documentation. Based on screenshots provided by the group, the leaked data is said to contain various types of information related to both the company's operations and its personnel. The specific types of data identified in the leak include:

• Customer data
• Driver information
• Driver's licenses
• Financial documents
• Order history

The presence of such diverse data types—ranging from personal identification to financial records—suggests a comprehensive breach of the organization's digital environment. RansomHub has not provided information regarding the specific ransom demand or the total file count involved in this incident.

About Skyway Coach Lines and Shuttle Services

Skyway Coach Lines is a transportation company based in Ontario, Canada. The organization specializes in providing a variety of transit services, including corporate transportation, airport transfers, and private group charter services. As a provider of essential transit solutions, the company manages a significant amount of logistical and personal data to facilitate its operations across the region.

Potential risks and industry implications

This breach may pose secondary risks such as identity theft and fraud for the organization's customers and employees. Because the organization is based in Canada, the incident may have legal implications under the Personal Information Protection and Electronic Documents Act (PIPEDA). The publication of the organization's data could weaken supply chain security and facilitate targeted phishing attacks against the company or its partners.

The RansomHub group has been linked to former ALPHV affiliates, and it is assessed that the group may employ double extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to release the stolen data on a public leak site, the attackers aim to pressure the victim into paying the ransom to prevent reputational damage or regulatory fines.

For organizations operating in the transportation and logistics sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Protecting sensitive customer and employee information is vital to maintaining trust and ensuring regulatory compliance. Organizations in this sector can take proactive steps to defend against such threats, including implementing strict access controls, maintaining regular offline backups, and conducting regular security awareness training for employees to recognize phishing attempts. Furthermore, monitoring for unauthorized data exfiltration and ensuring compliance with regional privacy laws, such as PIPEDA, remains a fundamental component of a modern defensive posture.