Constelacion Savings and Credit Society Targeted by RansomHub Ransomware Group
Incident Date:
April 24, 2024
Overview
Title
Constelacion Savings and Credit Society Targeted by RansomHub Ransomware Group
Victim
Constelacion Savings and Credit Society
Attacker
Ransomhub
Location
First Reported
April 24, 2024
RansomHub Targets Constelacion Savings and Credit Society in Ransomware Attack
Attack Overview
The ransomware group RansomHub has recently claimed responsibility for a cyberattack on Constelacion Savings and Credit Society, a prominent financial institution in El Salvador. According to the group's dark web leak site, they have obtained 497 gigabytes of data from the company's servers. Despite negotiations, the company has opted not to pay the ransom and is attempting to restore their systems from backups.
Company Profile
Constelacion S.A., founded on August 25, 2010, is a financial entity listed on the El Salvador Stock Exchange. The institution specializes in the placement of funds, collection of deposits, and providing diverse financial solutions to its clients. As a key player in the Salvadoran financial sector, Constelacion offers personal savings accounts, business loans, and investment opportunities, positioning itself as a secure and reliable financial service provider.
Vulnerabilities and Impact
The attack highlights potential vulnerabilities within Constelacion's cybersecurity framework. Financial institutions like Constelacion are attractive targets for cybercriminals due to the sensitive financial and personal information they hold. The breach not only risks the exposure of client data but also threatens the institution's reputation and operational stability. This incident underscores the critical need for robust cybersecurity measures in the financial sector, particularly for institutions that manage substantial amounts of sensitive data.
Attack Details
RansomHub's approach involved publishing a sample of the stolen data, including personal credit requests with sensitive customer information. This tactic is typical of ransomware groups seeking leverage in ransom negotiations. The ongoing threat of data exposure continues as the group claims to still have access to Constelacion's network.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.