In a new cyber-extortion incident, the World Leaks group — previously known as Hunters International — claims to have breached one of Dell Technologies ' demo platforms , extracting data that it is now using as leverage for ransom .
Dell confirmed the breach to BleepingComputer, explaining that the incident was limited to the Customer Solution Center, an isolated infrastructure designed exclusively for product testing and demonstrations to commercial customers. According to the company, this environment is completely separate from its production networks and does not contain sensitive customer data.
"The data used in this environment is synthetic or publicly available, and is intended solely for demonstration purposes and internal testing," a Dell spokesperson said.
See also: Century Support Services breach affects 160,000 people
Although World Leaks seeks to portray the breach as a major leak of medical and financial data, insiders and cybersecurity analysts believe most of it is false or tentative. The only real information stolen is reportedly a very old contact list, with no operational value.
Dell did not respondnoting that the investigation is ongoing.
Who are World Leaks – The new face of digital extortion
World Leaks is not a random cyber group. As we mentioned earlier, it is the evolution of the ransomware group Hunters International, which in turn was considered a possible revival of the infamous Hive ransomware (due to similarity in code).
Since its founding in late 2023, Hunters International has claimed responsibility for over 280 attacks internationally. However, as of January 2025, the ransomware attacks have ceased and the World Leaks , which deals exclusively with data theft and extortion of victims.
See also: Episource: Notifies customers of recent data breach
The gang focuses on targeted data theft, using specialized extraction tools and threatening to release the data via its leak site. So far, it has posted data from 49 organizations, although Dell has not yet publicly mentioned it on their site.
Macnica researcher Yutaka Sejiyama found that 10 of the victim organizations were using SonicWall SMA 100 appliances (no longer supported), which appear to have been the entry point for the attacks, through the installation of a specialized rootkit called OVERSTEP .
How does this affect the industry and what is the next step?
The Dell incident serves as a wake-up call for the entire technology market , and especially for companies that offer sandbox environments, demo platforms, and virtual labs to their customers. While these environments are designed to be secure and isolated, the reality is that cybercriminals are now exploiting even these to blackmail victims.
The incident also highlights the trend of ransomware gangs moving towards pure extortion tactics, avoiding complex system encryption. With this approach, attackers gain time and avoid leaving traces, while also targeting the victim’s brand reputation.
See also: New Fortinet FortiWeb breaches linked to public RCE exploits
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
For tech companies, the need for segregated environments and staff training is more critical than ever. But customers, too, need to understand their role — not to upload truly sensitive data, even in environments that appear secure.
Source: www.bleepingcomputer.com
