Taiwanese chipmaker ADATA is denying claims of a cyberattack by the RansomHouse group after the threat actors began posting stolen files on their data leak website.
See also: Callback phishing: Social engineering methods are evolving
On Tuesday, the RansomHouse gang added ADATA files to its data leak website, claiming to have stolen 1TB worth of documents in a 2022 cyberattack. The threat actors also leaked samples of allegedly stolen files, which appear to belong to the company.
See also: BidenCash: Offers 1,221,551 stolen credit cards for free
However, in a statement to BleepingComputer, ADATA says it has not suffered a recent cyberattack and that the leaked files come from a ransomware attack by the Ragnar Locker group that took place in May 2021 – that attack stole 1.5TB of data.
“Through various technical checks, we are confident that Ransomhouse’s claims are false and that this data was stolen by the Ragnar Locker group in 2021,” an ADATA spokesperson told BleepingComputer.
“After the Ragnar Locker group hit in 2021, ADATA retained information security experts and implemented effective methods to create strong protection. Since then, no attack on ADATA has been successful. None of ADATA’s confidential information has been leaked .”
Comparing the timestamps on the data shared by the RansomHouse group with the data leaked by the Ragnar Locker group in June 2021, both sets of stolen data have similar timestamps, with no file newer than May 2021.
See also: Solana: NFTs impersonating the Phantom security update are spreading malware
ADATA added that RansomHouse had not left a ransom note on its servers to prove an attack had occurred .
However, RansomHouse continues to claim that it recently breached ADATA in a data theft attack and that they had negotiated with the company for the stolen data.
Who is the RansomHouse team?
RansomHouse began its extortion operation in 2021 when its first victim, the Saskatchewan Liquor and Gaming Authority (SLGA), was breached.
The threat actors claim that they do not use any ransomware in attacks , but the White Rabbit ransom notes link the encryption attacks to Ransom House.
Most recently, RansomHouse claimed responsibility for attacks on eight municipalities in Italy.
During this attack, ransomware was used that appended the .mario extension to encrypted files and left a ransom note that “greeted” victims with “Buongiorno la mia bella Italia.”
RansomHouse has targeted other high-profile companies, including AMD and Shoprite Holdings, Africa's largest supermarket chain.
Information source: bleepingcomputer.com
