Underground ransomware group lists semex.com on its leak site

• Ransomware group: Underground
• Country: Canada
• Sector: Agriculture and Food Production
• Announcement date: April 16, 2025

Underground claims data breach at semex.com

The threat actor known as Underground has announced a data leak allegedly belonging to semex.com. According to the announcement made on a leak site, the breach involves a significant volume of data totaling 214.2 GB. This claim suggests that the organization's systems have been compromised, resulting in the unauthorized acquisition of sensitive information by the threat actor.

The announcement regarding the incident was published on April 16, 2025. While the leak site announcement occurred on that date, the threat actor claims the actual attack took place on April 15, 2025. Information regarding the specific identity and operational details of the Underground group remains limited in the public domain, making it difficult to ascertain much about their specific tactics or motivations beyond this single claim.

Details of the allegedly stolen data

The threat actor claims to have obtained a wide range of corporate and personal data from the organization's systems. The scope of the alleged theft is broad, covering various types of sensitive information that could impact both the company's operations and the privacy of its personnel. The data reportedly includes a variety of high-value assets ranging from financial records to intellectual property.

The specific items identified in the claim include:

• Financial documents
• Passport information
• Driver's licenses
• Employee salary and contract data
• Production formulas
• Confidential agreements

This type of data exfiltration is a hallmark of modern cyberattacks, where attackers aim to maximize leverage by targeting a diverse array of information types.

About Semex

Semex is a Canadian-based cooperative that provides global dairy and beef genetics, reproductive solutions, and livestock technologies. It is a global leader in genetic improvement and reproductive services within the industry. Given its role in the agriculture and food production sector, the organization maintains highly specialized processes and sensitive information essential to its global operations.

Potential implications and industry risks

The nature of the leaked data may pose secondary risks such as identity theft and targeted phishing attacks for the organization's employees and executives. Because the sensitive identity information, such as passports and driver's licenses, is reportedly involved, individuals within the company may face increased risks of fraud and social engineering attempts.

Furthermore, the publication of biotechnology and production formulas could potentially harm the organization's competitive advantage and result in the loss of intellectual property. In a highly specialized industry, the exposure of proprietary formulas is a critical risk. Additionally, the disclosure of confidential agreements and strategic plans may have negative implications for the organization's business partnerships.

As the organization is based in Canada, the exposure of personal data may lead to legal repercussions under local regulations such as PIPEDA. Organizations operating in the agriculture and biotechnology sectors often face complex regulatory environments, and breaches involving personal and proprietary data can trigger significant compliance requirements. In general, organizations facing such threats often focus on enhancing monitoring, implementing strict access controls, and strengthening employee awareness to mitigate the risks of data exfiltration and subsequent extortion.