Southern Acids listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: Malaysia
• Sector: Manufacturing
• Announcement date: December 12, 2024

Hunters group claims data breach at Southern Acids

The threat actor known as Hunters has listed data allegedly belonging to Southern Acids on their leak site. This announcement, which appeared on the platform on December 12, 2024, marks a significant development in the ongoing threat landscape facing manufacturing entities. The claim suggests that the organization's systems were compromised, leading to the exfiltration of a substantial volume of information.

In modern cyberattack scenarios, ransomware groups often employ a tactic known as double extortion. This method involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information before the encryption phase. The threat actors then threaten to leak this stolen data on public or semi-public platforms if a ransom is not paid. This approach places immense pressure on victims, as the threat of public exposure can lead to severe reputational and legal consequences, regardless of whether the organization can restore its systems from backups.

Details of the alleged exfiltration

According to the claims made by the Hunters group, the breach occurred on November 16, 2024. The group asserts that they successfully exfiltrated a significant amount of data from the organization's internal systems. While the specific nature of the files has not been detailed, the scale of the alleged theft is considerable.

The group claims the following regarding the stolen data:

• Total data size of 409.8 GB
• A total of 133,458 files

It is important to note that no specific details regarding the content of the leaked data have been provided by the attackers. The listing does not specify the types of files or the specific categories of information that were compromised, leaving the exact nature of the breach unknown.

About Southern Acids

Southern Acids (M) Berhad is a Malaysia-based manufacturing company. The company specializes in the production and marketing of oleochemical products, including fatty acids, glycerin, and soap noodles.

Impact and potential risks

This action by the Hunters group may negatively impact the organization's operational continuity and commercial reputation. Depending on the content of the leaked data, there may be a risk of exposure for personal information of employees or business partners. Furthermore, it is likely that the organization could face legal obligations under data protection regulations in Malaysia. Secondary risks may include the use of leaked information for identity theft or targeted phishing attacks.

Public information about the Hunters group is limited. While they have been active in the threat landscape, reports suggesting the group ceased encryption activities in 2025 may indicate a shift in their operational strategy. This shift could mean a greater focus on pure data exfiltration and extortion rather than traditional ransomware encryption.

For organizations operating in the manufacturing sector, such incidents highlight the necessity of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular offline backups. Additionally, monitoring for unauthorized data transfers and implementing strict access controls can help mitigate the risk of large-scale exfiltration. As threat actors evolve their strategies, staying informed about the tactics used by groups like Hunters is essential for maintaining organizational resilience.