World Leaks (Hunters International)
Cybercrime — data extortion (Hunters International rebrand) · Financial — pure data extortion (no ransomware encryption)
Tactics, Techniques & Procedures (TTPs)
- Pure data theft and extortion — no file encryption at any stage (strategic shift to avoid operational signals and legal complications of encryption)
- Rebranded from Hunters International ransomware to World Leaks in early 2025 to reduce law enforcement brand recognition
- Prioritises high-brand-value targets where data publication creates maximum reputational settlement pressure
- Supply chain targeting: organisations holding OEM intellectual property under weaker security than the OEM itself
- Large-volume exfiltration of high-sensitivity data (product schematics, manufacturing documents, employee PII, customer records)
- Leak site publication with countdown timers and sample data to demonstrate exfiltration without releasing everything
Known Targets
Analyst Notes
World Leaks is Hunters International rebranded in early 2025. Hunters International was itself assessed as a Hive ransomware successor after the FBI disrupted Hive in January 2023. The shift from file-encrypting ransomware (Hunters International) to pure data extortion (World Leaks) reflects deliberate strategic evolution: encryption creates operational detection signals, decryption key management overhead, and legal complications. The June 2026 Tata Electronics breach is the most significant supply chain data theft attributed to the group: Tata manufactures precision iPhone components and has relationships with Tesla, Qualcomm, and ASML. Authentic Apple schematics in the published data could facilitate component-level counterfeiting and targeted exploitation well beyond the immediate breach.
Also Known As