Tata Tech's confidential business info, employee details leaked on dark web by hackers

A ransomware group known as Hunters International has published data it claims to have stolen from Tata Technologies, more than a month after the Indian engineering services firm confirmed a cyberattack that disrupted some services.

The leaked data, posted on the gang’s dark web leak site, includes personal details of current and former employees, as well as confidential business information, such as purchase orders and company contracts in India and the United States, according to TechCrunch , which reviewed the files.

The ransomware group claims the data trove contains more than 730,000 documents totaling about 1.4 terabytes, including Excel spreadsheets, PowerPoint presentations, and PDFs.

Attack on Tata Technologies in January

In late January, Tata Technologies disclosed a ransomware attack to Indian stock exchanges, stating that some IT assets were affected but that client services remained fully functional.

It remains unclear whether the data leaked by Hunters International is related to the incident Tata Technologies acknowledged earlier this year.

Founded in 1989 as an automotive unit of Tata Motors, Tata Technologies became a separate company in 1994 and now operates as a subsidiary of the Tata Group. It provides product engineering and R&D services to automotive, aerospace, and engineering companies in 27 countries, with 20 delivery centers and a workforce of over 12,500 employees, according to its website.

New ransomware threat with old ties

Hunters International, which emerged in late 2023, operates as a ransomware-as-a-service group, leasing its infrastructure to affiliate hackers in exchange for a cut of ransom payments.

The group also appears to have links to the Hive ransomware gang, which was largely dismantled by law enforcement in 2023. Hive had previously leaked stolen data from Tata Power, another Tata Group subsidiary, following a 2022 cyberattack.

As cybersecurity threats continue to grow, Indian companies and multinational firms face increasing risks from ransomware groups targeting sensitive corporate data.