RansomHub Ransomware Attack on HLB Puerto Rico LLC Leads to Data Leak

Incident Date:

July 17, 2024

World map

Overview

Title

RansomHub Ransomware Attack on HLB Puerto Rico LLC Leads to Data Leak

Victim

HLB Puerto Rico LLC

Attacker

Ransomhub

Location

San Juan, Puerto Rico

, Puerto Rico

First Reported

July 17, 2024

RansomHub Ransomware Attack on HLB Puerto Rico LLC

Overview of HLB Puerto Rico LLC

HLB Puerto Rico LLC is a prominent accounting and consulting firm based in San Juan, Puerto Rico. As a member of HLB International, a global network of independent accounting firms and business advisors, HLB Puerto Rico leverages extensive local expertise and international reach. The firm specializes in tax preparation, bookkeeping, and consulting services, with a particular focus on helping clients navigate Puerto Rico's tax incentives, such as Act 60-2019. The firm is led by Keysha M. Torres Pérez, CPA, and employs a team of professionals dedicated to providing high-quality, personalized financial solutions.

Details of the Ransomware Attack

On July 18, 2024, HLB Puerto Rico LLC fell victim to a ransomware attack orchestrated by the cyber threat group RansomHub. The attack targeted the company's website, hlbpr.com, and resulted in a data leak, although the exact size of the leak remains undisclosed. This incident highlights the increasing threat of ransomware attacks on professional service firms and underscores the need for robust cybersecurity measures within the industry.

About RansomHub

RansomHub is a relatively new ransomware group that has quickly made a name for itself in the cyber threat landscape. Believed to have roots in Russia, RansomHub operates as a Ransomware-as-a-Service (RaaS) group, with affiliates receiving 90% of the ransom money and the main group taking the remaining 10%. The group is known for its use of Golang in its ransomware strains, a trend that is becoming more common in the ransomware world. RansomHub has targeted various countries, including the US, Brazil, Indonesia, and Vietnam, with a notable focus on healthcare-related institutions.

Potential Vulnerabilities and Attack Penetration

While the specific vulnerabilities exploited in the HLB Puerto Rico attack are not publicly known, professional service firms like HLB Puerto Rico are often targeted due to the sensitive financial data they handle. RansomHub likely penetrated the company's systems through common attack vectors such as phishing emails, exploiting software vulnerabilities, or leveraging weak security protocols. The use of AI technology by ransomware groups has also made attacks more effective and increased their frequency, posing significant challenges for organizations in maintaining robust cybersecurity defenses.

Sources

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.