Vertel listed on Space Bears ransomware leak site

• Ransomware group: Space Bears
• Country: Australia
• Sector: Technology
• Announcement date: June 17, 2025

Space Bears claims data breach at Vertel

The ransomware group known as Space Bears has listed the Australian telecommunications provider Vertel on its leak site. According to the announcement made on June 17, 2025, the threat actors claim to have successfully compromised the organization's systems and exfiltrated sensitive information.

The group alleges that the unauthorized access occurred on April 29, 2025. The claim suggests that the attackers were able to penetrate the organization's digital infrastructure to access various databases and internal documents. In recent cyberattack trends, many ransomware groups have shifted their focus away from traditional encryption-based attacks. Instead, they prioritize data exfiltration and extortion tactics, a method often referred to as double extortion. In these scenarios, attackers steal sensitive information and threaten to release it publicly unless a ransom is paid, leveraging the threat of reputational damage and legal consequences to pressure the victim.

Data types allegedly exfiltrated

While the specific volume of data and the exact number of files involved have not been disclosed by the group, the announcement identifies several categories of information that were reportedly stolen during the incident. The threat actor claims that the breach involved access to critical organizational assets, specifically targeting data that could be used for extortion purposes.

The information allegedly compromised includes:

• Database files (SQL)
• Personal client information
• Financial documents

The nature of these files suggests a significant breach of internal records and sensitive customer data.

About Vertel

Vertel is an Australian-based telecommunications carrier and managed ICT services provider. The company specializes in critical communications, wireless networks, fiber infrastructure, cloud services, and cybersecurity solutions. Given its role in providing essential connectivity and managed services, the organization serves as a vital component of the technological infrastructure for various clients.

Potential impact and industry considerations

This alleged breach may pose a critical risk given Vertel's role as a telecommunications infrastructure and managed services provider. The compromised client data could lead to legal repercussions under Australian privacy regulations and increase the risk of identity theft for affected individuals. Furthermore, because the organization serves government and corporate clients, the incident may create a vector for supply chain attacks and targeted phishing campaigns against its client base.

Given the data-exfiltration-focused nature of the Space Bears group, it is possible that the stolen data could be sold on secondary markets or used to exert further pressure on the organization. Such incidents can result in negative impacts on an organization's operational continuity and customer trust.

In the telecommunications and managed services sector, organizations typically face heightened risks due to the sensitive nature of the data they process. To defend against such threats, industry experts often recommend implementing robust security frameworks, including multi-factor authentication, strict access controls, and continuous monitoring of network traffic. Organizations in this sector often prioritize the segmentation of critical infrastructure from general business networks to limit the lateral movement of attackers. Additionally, maintaining comprehensive backups and conducting regular incident response drills are common defensive steps used to mitigate the impact of data exfiltration and extortion attempts.