SESAM Informatics Listed by hunters Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

SESAM Informatics, an organisation based in Senegal, was listed by the ransomware group known as hunters on or around 6 September 2024. Public reporting indicates that the group claims to have both encrypted systems and exfiltrated internal files. The number of people affected remains unknown, and further operational details have not been disclosed.

The listing itself constitutes a claim by the threat actor rather than independent confirmation of every asserted detail. What is established so far is limited to the organisation’s name, the country of operation, the reported date, and the dual assertion of encryption plus data theft. That limited picture is still consequential because ransomware incidents of this type routinely place internal corporate material at risk of wider exposure.

Inside the incident

According to the available record, SESAM Informatics appeared on the hunters leak site with a report date of 6 September 2024. The entry states that data were exfiltrated and that systems were encrypted. No technical description of the initial access method, the duration of the intrusion, the volume of material taken, or any ransom demand has been made public. The number of individuals whose information may have been involved is listed as unknown. Public detail is therefore confined to the dual claim of encryption and exfiltration of internal files; everything else remains undisclosed.

Who is hunters?

Hunters is a ransomware operation that has appeared in multiple public breach listings. Like other groups that practise double extortion, it typically claims to encrypt victim systems while simultaneously removing copies of data, then pressures the organisation by threatening to publish the material on a dedicated leak site. The group’s listings are self-reported claims; independent verification of the precise contents or the success of encryption is rarely available at the moment of publication. Prior activity attributed to hunters follows the same pattern of naming a victim, asserting that files were stolen, and offering samples or full dumps if payment is not made. In the present case the only specific assertion tied to SESAM Informatics is the leak-site entry itself; no additional statements by the group about this victim have been recorded in the facts.

SESAM Informatics and its sector

SESAM Informatics operates in Senegal within the informatics and information-technology sector. Organisations of this type commonly develop, host or support software systems, manage digital infrastructure, or provide IT services to clients. As a result they routinely hold internal business records, project documentation, credentials, correspondence, and sometimes client or partner data. A ransomware incident affecting such an entity is consequential because the same systems that support day-to-day operations can also contain material whose unauthorised release could affect commercial confidentiality, contractual relationships, or the privacy of individuals whose details appear in those files. The precise business model and client base of SESAM Informatics have not been detailed in the breach record, so any assessment of impact rests on the general profile of an informatics firm rather than on confirmed internal structure.

The information in question

The facts name the exposed material simply as “internal files” that were allegedly exfiltrated during a ransomware attack. Encryption of data is also asserted. No further breakdown—such as employee records, customer databases, source code, financial documents or credentials—has been supplied. Organisations working in informatics typically store project files, configuration data, internal communications and administrative records; whether any of those categories were among the files claimed by hunters remains unconfirmed. Because the exact contents are undisclosed, it is not possible to state with certainty what personal or commercial information, if any, left the organisation’s control.

Why it matters

When internal files are both encrypted and removed, two immediate risks arise. First, the organisation itself may face operational disruption while systems are restored, potentially delaying services for clients or partners. Second, any personal or sensitive commercial data contained in those files could later appear in secondary markets or be used for further fraud, social engineering or competitive harm. Individuals whose details happen to be present—employees, contractors or clients—may experience identity-related risks ranging from phishing to account takeover, even if they never interacted directly with the attackers. For SESAM Informatics the reputational and contractual consequences of a confirmed leak could include regulatory scrutiny under applicable data-protection rules and the need to notify affected parties once the scope becomes clearer. All of these outcomes remain contingent on verification of the group’s claims; at present they represent plausible rather than proven harms.

Were you affected?

If you have a past or present relationship with SESAM Informatics—as an employee, contractor, client or partner—consider the following practical steps:

• Monitor official statements from the organisation for any confirmation of the incident and guidance on notification.
• Change passwords on accounts that may have been used in connection with SESAM Informatics systems, and enable multi-factor authentication where available.
• Watch financial and email accounts for unusual activity that could indicate misuse of personal details.
• Treat unsolicited messages that reference the company or the breach with caution, as threat actors sometimes exploit public listings for follow-on phishing.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already surfaced elsewhere.

Public information remains limited; further clarity will depend on any subsequent disclosures by SESAM Informatics or independent investigators. Until then, the prudent course is to assume that internal material may have left the organisation’s control and to take the protective measures above.

AICompiled with AI assistance from public sources and published under our editorial standards.