Structural and Steel Products targeted by Hunters ransomware group

• Ransomware group: Hunters
• Country: United States
• Sector: Manufacturing
• Announcement date: October 10, 2024

Hunters ransomware group claims attack on Structural and Steel Products

The Hunters International ransomware group has listed the United States-based company Structural and Steel Products on its dedicated leak site. According to the announcement made on October 10, 2024, the threat actor group claims to have successfully breached the organization's systems, resulting in both data exfiltration and encryption activities. The group alleges that they have gained unauthorized access to the company's internal environment, leading to a significant compromise of digital assets.

Ransomware attacks often follow a pattern of double extortion, where attackers not only encrypt a victim's files to disrupt operations but also steal sensitive information to use as leverage. By threatening to release stolen data on a public leak site, these groups aim to pressure organizations into paying a ransom to prevent the exposure of proprietary or sensitive information. This tactic increases the pressure on the victim, as the loss of data can lead to long-term reputational and legal consequences even if systems are restored from backups.

Details of the alleged data exfiltration

The announcement by the Hunters International group provides specific metrics regarding the scale of the alleged breach. The group claims to have compromised a massive dataset that could significantly impact the victim's digital footprint. According to the group's claims, the stolen information includes:

• A total volume of 558.8 GB of data
• A file count consisting of 510,337 files

While the group has provided these specific quantities, they have not provided any specific details regarding the actual content of the allegedly exfiltrated data. No specific information has been released concerning the nature of the files, such as whether they contain financial records, intellectual property, or personal identifiers. The information currently available is limited to the volume and the file count as indicated by the group's screenshots.

About Structural and Steel Products

Structural and Steel Products is a company based in the United States that operates within the manufacturing sector. The organization specializes in the production and supply of various steel components designed for industrial and commercial projects. Their expertise lies in the field of structural steel products and metal manufacturing, providing essential materials for large-scale infrastructure and construction needs.

Impact assessment and industry implications

The claims made by the Hunters International group could have a profound impact on the operational continuity of Structural and Steel Products. A successful breach of this magnitude potentially exposes sensitive information, such as trade secrets and employee records, which are vital to the company's competitive advantage and internal administration. Furthermore, the leaked data could be utilized by malicious actors for secondary risks, including targeted phishing campaigns and identity theft attacks against the company or its stakeholders.

Because the company is based in the United States, the incident may trigger various legal considerations. State-level data protection laws and potential notification requirements may apply depending on the nature of the data involved and the jurisdiction. Organizations in the manufacturing sector often face unique challenges during such incidents, as the theft of technical specifications or supply chain details can disrupt business relationships and long-term projects.

It is noteworthy that the Hunters International group is assessed to be derived from the Hive codebase. This connection suggests that the attackers may be employing methodologies and techniques similar to those used by the Hive ransomware group. For organizations looking to defend against such threats, common defensive steps include maintaining robust, offline backups, implementing multi-factor authentication across all remote access points, and conducting regular security awareness training to mitigate the risk of initial access via phishing.