Zuni Data listed on leak site by crazyhunter

• Ransomware group: crazyhunter
• Country: Taiwan
• Sector: Technology
• Announcement date: March 30, 2025

The Taiwan-based technology company Zuni Data has been listed on a ransomware leak site by a threat actor known as crazyhunter. The announcement, made on March 30, 2025, marks a significant escalation in the threat facing the organization, as the group claims to have successfully breached their systems.

The claims of crazyhunter

According to the claims made by the crazyhunter group, the systems belonging to Zuni Data have been encrypted. In addition to the encryption of local systems, the threat actor asserts that they have successfully exfiltrated 800 GB of data from the organization's environment. The group has stated that they have also managed to disable the organization's backup systems, a tactic often used by ransomware operators to increase pressure on the victim by removing their ability to restore data independently.

The threat actor has issued a ransom demand of 300,000 USD. The group has threatened to release the stolen data if this demand is not met. Throughout the announcement, the group has employed a mocking tone regarding the security measures implemented by the organization. This psychological element is a common feature in modern ransomware attacks, where attackers attempt to undermine the confidence of the target organization.

Data involved in the alleged breach

The threat actor has claimed that a variety of sensitive corporate information has been exfiltrated during the attack. The data mentioned in the leak site announcement includes critical business information that could be highly sensitive if released publicly. The specific types of data claimed to be involved include:

• CRM data
• BPM data
• EIP data
• ERP data

The exfiltration of such diverse datasets suggests a broad access level within the organization's network, potentially touching multiple core business processes.

About Zuni Data

Zuni Data is a technology company based in Taiwan. The organization operates in the field of data management and technology solutions, providing essential digital infrastructure and services within its sector.

Impact and organizational implications

This incident may affect the operational continuity of Zuni Data and could result in the exposure of sensitive data. Such a breach can create secondary risks for the organization's customers and employees, including the potential for identity theft or targeted phishing attacks. Furthermore, the organization may face legal obligations under Taiwan's data protection regulations due to the nature of the exfiltrated information.

The crazyhunter group appears to be employing double-extortion tactics. Double extortion is a method where attackers not only encrypt an organization's data to disrupt operations but also steal the data beforehand to threaten its public release. This tactic is designed to maximize leverage, as even if an organization can recover from backups, they still face the threat of reputational damage and regulatory penalties if their data is leaked.

Public information regarding the crazyhunter group remains limited. However, the failure to meet the ransom demand may lead to the publication of the data, which could result in significant reputational damage for the organization. In the technology and data management sector, maintaining the integrity and confidentiality of client data is paramount, and breaches of this nature can have long-lasting consequences for business trust and legal standing.

General defensive considerations

While specific details regarding the breach are limited to the claims made by the attacker, incidents involving double extortion highlight the importance of robust security frameworks. Organizations typically focus on multi-layered defense strategies to mitigate such risks. This includes maintaining offline or immutable backups to counter the disabling of online backup systems, implementing strict access controls to protect sensitive data such as ERP and CRM systems, and conducting regular monitoring to detect unauthorized data exfiltration. Furthermore, proactive measures such as employee training to prevent initial access and comprehensive incident response planning are essential for managing the fallout of a potential breach.