World Leaks

World Leaks is a cybercriminal extortion group that emerged in early 2025 as a rebrand of the Hunters International ransomware operation, which had been active since 2023. Reporting in the provided content describes World Leaks as the successor to Hunters International and notes a strategic shift away from file encryption toward pure data theft and leak-based extortion, with the group stealing company data and threatening public release unless payment is made. Known aliases in the content are World Leaks, WorldLeaks, world_leaks, and Hunters International. The group has been linked in the content to incidents affecting organizations in manufacturing, healthcare, technology, consumer services, and energy, with many claimed victims in the United States as well as victims in Europe, Canada, India, and China. Specific victim claims or links mentioned in the content include Tata Electronics, Nike, Dell, Bradford Health Services/Bradford Health Partners, Fred Hutchinson Cancer Center, and other organizations listed on its leak site. For Tata Electronics, World Leaks claimed to have stolen and published more than 200,000 files totaling over 630 GB, and reporting cited alleged exposure of emails, event logs, employee passport copies, SAP-related records, and documents tied to Apple and Tesla. The content also states that World Leaks made ransom demands in connection with Tata Electronics and that researchers observed the data on the group’s Tor-accessible dark web site. In the Nike case, World Leaks claimed theft of 1.4 TB across 188,000 files. The content also notes that some prior claims, such as Dell, involved more limited data than initially implied. The provided reporting states that World Leaks focuses on data exfiltration and extortion rather than encrypting victim systems. One source in the content says the group commonly gains initial access through phishing, compromised credentials, or exploitation of exposed services, then performs data discovery and exfiltration, prioritizing confidential corporate or personal information. The content also notes Hunters International use of Rclone as a primary exfiltration tool with WinSCP as a fallback in some intrusions. World Leaks is described in the content as an active extortion actor in the broader ransomware ecosystem despite its move away from encryption, and one report identifies LockBit, World Leaks, and TheGentlemen as leading groups observed targeting organizations in China.