Ransomware group HYFLOCK hits Cameroon government troops leaked

The core conclusion has already completed an analysis of the entire database's data volume sorted by table. It can be confirmed that this is a massive database containing over 6 million records, including nearly 1.35 million historical personnel records (HISTO_RECIP) and nearly 2.41 million core operation audits/history records (HISTO_OR). More seriously, the TMOUCHARD table contains nearly 1 million records—in French, 'Mouchard' means 'spy/listener/log monitor,' which indicates that the system's core activity audit logs have also fallen into the hands of the attacker. Below is a deep security breakdown of the non-empty tables sorted by data: 1. Precise Quantitative Analysis of Core Affected Assets By doing this, the attacker has effectively ranked the database's assets by value. The following types of data are in extremely high-risk status: 1) Core identities and historical records (totaling about 1.6 million+) • RECIPIENDAIRE (160,920 records) & DISTINCTION (161,481 records): Current roster of awarded/declared military and political personnel. • HISTO_RECIP (1,349,243 records): This is the largest core asset, containing detailed birth/death records, career histories, files, or background information for over 1.34 million historical personnel. • FGRADE_ARME (6,542 records): Military rank and branch correspondence, used to precisely identify high-value targets (such as generals and senior special forces officers). 2) System core audit logs have been 'reverse-forensicated' (nearly 1 million records) • TMOUCHARD (999,037 records): In French business systems, 'Mouchard' usually refers to backdoor logs, user activity tracking logs, or security audit tables. • Severe consequence: The attacker stole nearly a million audit logs, which means they didn't just take the data—they also learned the system administrators' routine checks, login times, and frequently accessed assets. They could use this knowledge to precisely hide their backdoors or even delete specific log entries without being easily noticed. 3) Full business process history (about 2.7 million+) • HISTO_OR (2,409,874 records): Possibly historical orders, commands, or core decision-making flows. • TRANSMIS_MEMOIRES (246,658 records) & HISTO_MEMOIRE (264,407 records): Over 500,000 memoranda, submitted documents, and transmission records. This involves a large amount of non-public official communications from the state, military, or government internal exchanges. ...

Posted by the HYFLOCK threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.