Tharisa listed on Termite ransomware leak site

• Ransomware group: Termite
• Country: Cyprus
• Sector: Energy & Utilities
• Announcement date: December 17, 2024

Termite claims data compromise at Tharisa

The threat actor known as Termite has listed Tharisa, an entity operating in the energy and utilities sector, on its leak site. The group announced the listing of the organization on its platform on December 17, 2024. According to the announcement, the threat actor claims that data belonging to the organization has been compromised.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The threat actors then threaten to leak this stolen data on public or private leak sites if a ransom is not paid. This approach places immense pressure on companies by threatening their reputation and legal standing, even if the organization has robust backups to restore its technical operations.

In this specific instance, the Termite group's announcement regarding the listing occurred on December 17, 2024, which coincides with the date the attack was claimed to have taken place. However, the group has not provided specific details regarding the nature of the incident or the scope of the breach.

Details of the claimed breach

Despite the listing, the announcement remains vague regarding the specifics of the incident. There is no information provided in the announcement regarding the nature of the compromised or threatened data. Furthermore, the group has not disclosed any specific information regarding a ransom demand or the volume of the compromised data. The listing names no specific data types.

When organizations face such claims, the lack of transparency from the threat actor can create significant uncertainty. Without knowing the volume of data or the specific types of files involved, it is difficult for the targeted entity to immediately assess the full scope of the potential exposure. This ambiguity is a common characteristic of many ransomware group announcements, where the primary goal is to exert maximum psychological pressure on the victim.

About Tharisa

Tharisa is an integrated resource group critical to the energy transition and decarbonisation of economies. The company operates in the mining, processing, exploration, marketing, and logistics of platinum group metals (PGMs) and chrome concentrates.

Potential impacts and risks

This incident may create negative impacts on Tharisa's operational continuity and corporate reputation. Depending on the type of data claimed to be compromised, the organization's trade secrets or operational processes could be at risk. As a Cyprus-based entity, any potential data breach may lead to legal consequences under the EU General Data Protection Regulation (GDPR).

Secondary risks may include the potential use of leaked information for identity theft or targeted phishing attacks. In the energy and utilities sector, such risks are particularly sensitive as they can affect critical infrastructure and supply chains. Organizations in this sector often implement defensive measures such as network segmentation, multi-factor authentication, and continuous monitoring to mitigate these risks.

Public information regarding the Termite group is limited, therefore the group's motivations and methods remain uncertain. When dealing with such actors, organizations typically focus on incident response protocols, forensic investigations to determine the entry point, and legal consultations to manage regulatory compliance requirements.