RANSOMHOUSE

RansomHouse is a financially motivated threat actor that distinguishes itself from conventional ransomware operations through its explicit rejection of file-encrypting ransomware in favour of a pure data theft and extortion model. The group positions itself as a "marketplace" connecting data thieves with buyers and extorting victims simultaneously.

RansomHouse claims to have no interest in encrypting victim systems, arguing that such disruption is counterproductive and that stolen data alone provides sufficient leverage for extortion. This approach reduces collateral damage and operational complexity while maintaining comparable extortion pressure.

The group claimed responsibility for a significant attack on Advanced Micro Devices (AMD) in 2022, alleging the theft of 450 GB of data including research materials, financial information, and employee data. They have also targeted major healthcare organisations, hotel chains, and retail enterprises. RansomHouse maintains a data leak site where they publish victim profiles and sample data to demonstrate breach validity and pressure payment.

RansomHouse's "marketplace" framing and data-only approach reflects a broader evolution in the cybercriminal ecosystem toward sophisticated extortion operations that maximise financial return while minimising operational risk and law enforcement attention compared to disruptive ransomware deployments.