Tata Technologies Suffers Major Ransomware Attack – Hackers Claim Data Theft

Tata Technologies, a subsidiary of Tata Motors and a leading multinational engineering and technology company, experienced a ransomware attack in January 2025. The attack led to temporary suspension of some IT services, though client delivery operations remained unaffected. Initially, no major ransomware group claimed responsibility.

Severity Level: High

Threat Details

1. Attack Claim by Hunters International:

• The Hunters International ransomware group has since claimed responsibility.
• The group alleges it stole 1.4TB of data, consisting of 730,000 files.
• The exact nature of the stolen files remains undisclosed.
• They have threatened to release the stolen data within one week if their ransom demand is not met.
• No samples of the stolen files have been publicly shared by the attackers.

2. Company’s Response:

• Tata Technologies acknowledged the security breach and confirmed an ongoing investigation with cybersecurity experts.
• The company restored impacted IT systems but has not yet commented on the data theft claim by Hunters International.

3. Threat Actor Background:

• Hunters International is believed to be a rebrand of the now-defunct Hive ransomware group.
• Target regions: the U.S., the UK, the EU, South America, and Asia
• They are notorious for double extortion tactics, where they demand a ransom for both decrypting files and preventing data leaks.

4. Lessons Learned:

• The Hunters International ransomware attack on Tata Technologies underscores the growing threat of sophisticated ransomware groups targeting engineering & technology firms.
• This incident serves as a wake-up call for enterprises to prioritize cybersecurity investments, implement robust data protection strategies, and enhance ransomware resilience through proactive threat intelligence and security controls.

Recommendations

1. Identify & patch critical vulnerabilities in operating systems, applications, & network devices.
2. Deploy advanced EDR & XDR solutions to detect and stop ransomware activities in real time.
3. Companies should actively monitor dark web forums and ransomware extortion sites to detect early indicators of data leaks.
4. Maintain encrypted, offline, and immutable backups to ensure rapid recovery in case of data encryption.
5. Use end-to-end encryption and Data Loss Prevention (DLP) tools to secure sensitive data.
6. Implement email filtering solutions and user training to prevent phishing-based intrusions.
7. Develop and test a ransomware-specific response plan with defined roles for IT, legal, and executive teams.
8. Evaluate data breach notification laws & GDPR-like regulations that may apply to stolen data.
9. In case of a cyberattack report it to cybercrime authorities (e.g., CERT-In, INTERPOL) for assistance in tracking ransomware actors.

Source:

• https://www.bleepingcomputer.com/news/security/indian-tech-giant-tata-technologies-hit-by-ransomware-attack/
• https://www.bleepingcomputer.com/news/security/hunters-international-ransomware-claims-attack-on-tata-technologies/

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.