Tata Technologies, a subsidiary of Tata Motors and a leading multinational technology company, has reportedly fallen victim to a ransomware attack allegedly carried out by the Hunters International ransomware group. The cybercriminal group claims to have stolen 1.4 terabytes of sensitive data and is now threatening to leak it.
According to a regulatory filing with the Indian National Stock Exchange, the attack took place in January, affecting a limited number of the company’s IT assets. The company, which specializes in product engineering and provides services to original equipment manufacturers in the automotive, aerospace, and industrial machinery sectors, stated that it had taken precautionary measures in response to the breach.
“Pursuant to Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, this is to inform you that the Company has become aware of a ransomware incident that has affected a few of our IT assets,” Tata Technologies disclosed in the filing. “As a precautionary measure, some of the IT services were suspended temporarily and have now been restored. Our client delivery services have remained fully functional and unaffected throughout.”
The company emphasized that it had swiftly taken action to contain the threat, temporarily disconnecting affected IT services, all of which have since been restored. It has also notified relevant authorities and enlisted external cybersecurity experts to conduct a thorough investigation into the incident.
The Hunters International ransomware group has now listed Tata Technologies among its victims on its Tor leak site. The hackers claim to have accessed over 730,000 files containing confidential business data. The extent of the breach and the nature of the compromised information remain under investigation.
This incident comes in the wake of a previous cyberattack on Tata Power, India’s largest power generation company, which suffered a security breach in October 2022. That attack, attributed to the Hive ransomware group, compromised critical IT infrastructure and resulted in the exposure of sensitive documents, including financial records, engineering projects, and personally identifiable information (PII) of employees.
Cybersecurity analysts suspect that Hunters International may be a rebranded version of the Hive ransomware gang, which saw its infrastructure seized by international authorities. Researchers have observed significant similarities in the code used by both groups, suggesting a possible continuation of Hive’s activities under a new identity.
