Ransomware Attack on Magicolor Peinture Industrielle by Hunters International

Overview of the Incident

Magicolor Peinture Industrielle, a prominent industrial painting service provider based in Quebec, Canada, has fallen victim to a ransomware attack orchestrated by the cybercriminal group known as Hunters International.

Company Profile

Established in 1993 by Jacques and Pierre Tremblay, Magicolor has evolved into a key player in the industrial coatings and painting sector. With a focus on services such as liquid and powder coatings, sandblasting, and distribution of industrial paints, the company has carved out a niche in providing specialized solutions to the manufacturing industry. Under the leadership of Johnny Morency, who became the sole shareholder in 2017, Magicolor has continued to expand and innovate, most recently acquiring the liquid coatings distribution business from Peintures Prolux in 2023.

The company's annual revenue stands at approximately $5 million, underscoring its significant role within the local and sector-specific markets.

Details of the Attack

Hunters International, a group known for its data theft rather than traditional encryption-based ransomware attacks, claims responsibility for this incident. This attack highlights a shift in tactics from encryption to data exfiltration, aiming to leverage stolen data for ransom.

Vulnerabilities and Industry Impact

The industrial painting sector, while specialized, contains inherent vulnerabilities typical of manufacturing and production environments. These include the extensive use of industrial control systems and interconnected IT infrastructures, which can be exploited by cybercriminals. Magicolor's recent expansions and acquisitions might have exposed new digital vectors susceptible to such attacks, highlighting the necessity for resilient cybersecurity strategies with evolving risks. .

Sources

• Profile of Hunters International - SOCRadar
• The Ransomware Hunting Team - NPR
• Hive Ransomware Group Profile - SOCRadar
• Cybersecurity Advisory - CISA
• Open Source Data Tracking Threat Actors - Infosecurity Europe