RansomHub Strikes Aedifica Montreal in Major Data Breach
Incident Date:
July 3, 2024
Overview
Title
RansomHub Strikes Aedifica Montreal in Major Data Breach
Victim
Aedifica Montreal
Attacker
Ransomhub
Location
First Reported
July 3, 2024
Ransomware Attack on Aedifica Montreal by RansomHub: An In-depth Analysis
Company Profile: Aedifica Montreal
Aedifica Montreal, a prominent architecture and design firm based in Montreal, Canada, has established itself as a leader in the construction sector with a focus on sustainable and innovative design solutions. Founded in 1985, the company employs 148 people and boasts a revenue of $26.9 million. Aedifica's diverse portfolio includes commercial, residential, institutional, and hospitality projects, emphasizing a client-centric approach that integrates architecture, interior design, and strategic planning under one roof. Their commitment to sustainability is reflected in their adoption of green building practices and technologies, which not only reduce environmental impact but also lower operating costs for clients.
Details of the Ransomware Attack
The ransomware group RansomHub has targeted Aedifica Montreal, claiming responsibility for a significant breach on their dark web leak site. The attackers have criticized Aedifica for its alleged lax security measures concerning data protection. According to RansomHub, they accessed the company's network for an extended period, during which they extracted detailed information on Aedifica's projects and client data spanning over a decade. The stolen data includes sensitive documents such as non-disclosure agreements, confidentiality agreements, floor plans, and project layouts. High-profile projects involving clients like Zurich Insurance and Adidas Originals were also compromised. RansomHub has threatened to release the data in segments if their demands are not met.
Profile and Tactics of RansomHub
RansomHub, a relatively new player in the cyber threat landscape, operates as a Ransomware-as-a-Service (RaaS) group. With suspected roots in Russia, the group allows affiliates to retain 90% of ransom payments, with the remaining 10% going to the core operators. RansomHub's ransomware is developed using Golang, a programming language increasingly favored by cybercriminals for its efficiency and versatility. The group has targeted various sectors and countries, demonstrating a capability to execute widespread and effective ransomware campaigns.
Potential Vulnerabilities and Entry Points
The extensive duration RansomHub spent within Aedifica's network suggests possible vulnerabilities in the firm's cybersecurity defenses. These could include inadequate endpoint protection, lack of employee training on phishing attacks, or insufficient network monitoring and response. The detailed nature of the stolen data also indicates that the attackers likely had access to privileged user credentials, which could have been obtained via spear phishing or exploiting unpatched systems.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.