Ransomware Gang Leaks Data Stolen from Tata Technologies

A ransomware group known as Hunters International has published a portion of the data it claims to have stolen from Tata Technologies, an Indian engineering and product development company. The leak comes just over a month after Tata Technologies confirmed a ransomware attack that disrupted some of its services.

The leaked data, posted on the gang’s dark web site, includes sensitive information such as personal details of current and former employees, purchase orders, and contracts with customers in India and the United States. Hunters International claims the dataset contains over 730,000 documents, including Excel spreadsheets, PowerPoint presentations, and PDF files, totaling approximately 1.4 terabytes.

In late January, Tata Technologies notified Indian stock exchanges of a ransomware attack that impacted “a few of” its IT assets. At the time, the company assured that its client services remained operational and unaffected. However, it is unclear whether the data leaked by Hunters International is connected to the attack disclosed earlier this year. Tata Technologies has not responded to multiple requests for comment from TechCrunch.

Established in 1989 as an automotive unit of Tata Motors, Tata Technologies became a separate entity in 1994 and now operates as a subsidiary of the Tata Group. The company provides product engineering and research and development services to automotive, aerospace, and engineering firms across 27 countries. It employs over 12,500 people and operates 20 delivery centers globally.

Hunters International, a relatively new ransomware-as-a-service (RaaS) group, emerged in late 2023. The group leases its infrastructure to affiliate hackers who carry out ransomware attacks, taking a share of the ransom payments. Hunters International is also believed to have ties to the Hive ransomware gang, which was largely dismantled by law enforcement in 2023. Notably, Hive previously leaked data stolen from another Tata Group company, Tata Power, in 2022.

This incident highlights the growing threat of ransomware attacks targeting large corporations and the potential for significant data breaches, even as companies work to maintain operational continuity. The leak underscores the need for robust cybersecurity measures to protect sensitive information and mitigate the impact of such attacks.