Tharisa Listed by termite Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target industrial and resource-sector organisations, using double-extortion tactics that combine encryption with the threat of public data leaks. Listings on criminal leak sites have become a routine pressure tool, even when independent confirmation of the intrusion remains limited. Against that backdrop, the appearance of Tharisa on a ransomware group’s site in mid-December 2024 fits a familiar pattern of claims directed at companies whose operations sit at the intersection of mining, processing and global commodity markets.

Public reporting on 17 December 2024 stated that the ransomware group known as termite had listed Tharisa, describing the incident as involving the exfiltration of internal files. The number of people affected is unknown, and further technical detail has not been released. The listing itself remains an unverified claim by the group.

Inside the incident

According to the available record, termite listed Tharisa on or around 17 December 2024. The sole concrete description provided is that internal files were allegedly exfiltrated in a ransomware attack. No public statement has confirmed the date of initial access, the vector used, the volume of data taken, or whether systems were encrypted. The number of individuals whose information may have been involved is listed as unknown. Because the facts stop at the group’s claim of exfiltration, any additional operational timeline or scale remains undisclosed.

The group behind it: termite

Termite is a ransomware operation that follows the now-standard double-extortion model: data is stolen before or during encryption, and the victim is threatened with publication on a dedicated leak site if a ransom is not paid. Like many contemporary groups, termite relies on affiliate-style recruitment, commodity initial-access techniques, and public shaming via leak portals. Prior activity attributed to the group has focused on mid-sized and larger enterprises across multiple sectors, with listings typically accompanied by sample files or directory trees intended to prove possession. In this case the group claims to have obtained internal files belonging to Tharisa; that claim has not been independently verified in the public record.

About Tharisa

Tharisa is an integrated resource group whose activities span mining, processing, exploration, beneficiation, marketing, sales and logistics of platinum-group metals and chrome concentrates. The company positions itself as contributing to the energy transition and the decarbonisation of economies through the supply of materials used in catalytic converters, batteries and related industrial processes. Organisations of this type routinely hold operational data, employee and contractor records, commercial contracts, geological and production information, and logistics documentation. A breach affecting such an entity therefore carries potential consequences for both workforce privacy and the integrity of sensitive commercial and technical material.

What data was at risk

The only data category named in the public facts is “internal files” said to have been exfiltrated. Exact file types, volumes or whether personal data of employees, contractors or business partners were included have not been disclosed. Mining and resource companies typically maintain personnel files, payroll and benefits data, health-and-safety records, supplier and customer contracts, financial statements, and proprietary technical documents. Because none of these categories has been confirmed as present in the claimed exfiltration, the precise contents remain unconfirmed.

The real-world impact

For individuals, the principal risks centre on the possible exposure of personal or employment-related information that could later be used for phishing, identity fraud or social-engineering attempts. For the organisation, the consequences include potential disruption to operations, reputational harm, regulatory scrutiny under data-protection regimes, and the cost of forensic investigation and remediation. Because the scale of the claimed breach is unknown, the actual breadth of these risks cannot yet be quantified. The listing itself may already generate secondary effects such as increased phishing volume directed at staff or partners who learn of the claim through media reports.

Were you affected?

If you are a current or former employee, contractor or business partner of Tharisa, treat the listing as a prompt for basic hygiene rather than confirmed compromise. Practical first steps include:

• Monitor bank and credit accounts for unusual activity and enable transaction alerts where available.
• Be alert to unexpected emails or messages that reference the company or request credentials or payments; verify any such contact through known official channels.
• Change passwords for work-related and personal accounts that may have been reused, and enable multi-factor authentication wherever possible.
• Review recent account statements and credit reports for signs of new accounts or inquiries opened in your name.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in other incidents.

Public detail on this incident remains limited. Further official statements from Tharisa or independent confirmation would be required before the full scope can be assessed. Until then, the prudent course is heightened vigilance rather than assumption of widespread personal-data exposure.

AICompiled with AI assistance from public sources and published under our editorial standards.