fog
First seen July 16, 2024Active189 claimed victims
The claims below are reproduced as posted by fog on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Ober Mountain (OberGatlinburg.com) | December 26, 2024 | ransomware_live | — |
| Aroma Housewares Co (Aromaco.com) | December 25, 2024 | ransomware_live | — |
| Industria e Comercio Jolitex Ltda (jolitex.com) | December 23, 2024 | ransomware_live | — |
| Gallade Chemical (galladechem.com) | December 23, 2024 | ransomware_live | — |
| Forum Architecture & Interior Design (forumarchitecture.com) | December 23, 2024 | ransomware_live | — |
| RODS Surveying (rods.cc) | December 23, 2024 | ransomware_live | — |
| EP Holdings (epholdingsinc.com) | December 20, 2024 | ransomware_live | — |
| Howell Township Public Schools (howell.k12.nj.us) | December 20, 2024 | ransomware_live | — |
| Circle Electric (circleelectric.com) | December 20, 2024 | ransomware_live | — |
| Village Community School (vcsnyc.org) | December 20, 2024 | ransomware_live | — |
| Schenkelberg - Die Medienstrategen (schenkelberg-druck.de) | December 20, 2024 | ransomware_live | — |
| Energy Capital Credit Union (eccu.net) | December 19, 2024 | ransomware_live | — |
| Jet Edge (jetedgewaterjets.com) | December 19, 2024 | ransomware_live | — |
| Reliance Connects (relianceconnects.com) | December 18, 2024 | ransomware_live | — |
| Vroninks Ricker Weyts & Sacre- Notaires (notassoc.be) | December 18, 2024 | ransomware_live | — |
| Ouro Verde (ouroverde.net.br) | December 17, 2024 | ransomware_live | — |
| SpeedLine Solutions (speedlinesolutions.com) | December 17, 2024 | ransomware_live | — |
| Waverley Christian College (wcc.vic.edu.au) | December 16, 2024 | ransomware_live | — |
| Cognity (cognity.gr) | December 16, 2024 | ransomware_live | — |
| Planters Telephone Cooperative (planters.net) | December 11, 2024 | ransomware_live | — |
| Dorner (dorner-gmbh.de) | December 5, 2024 | ransomware_live | — |
| Conlin's Pharmacy (conlinspharmacy.com) | December 2, 2024 | ransomware_live | — |
| Weld Racing (weldracing.com) | November 29, 2024 | ransomware_live | — |
| WPM Pathology Laboratory (wpmpath.com) | November 28, 2024 | ransomware_live | — |
| Bedminster School (bedminsterschool.org) | November 28, 2024 | ransomware_live | — |
| ALLTUB Group (alltub.com) | November 28, 2024 | ransomware_live | — |
| Chanas Assurances S.A. (chanasassurances.com) | November 28, 2024 | ransomware_live | — |
| Signal Health Washington (signalhealthwa.com) | November 27, 2024 | ransomware_live | — |
| Gruber Tool & Die (grubertool.com) | November 27, 2024 | ransomware_live | — |
| Metroline (metrolinedirect.com) | November 26, 2024 | ransomware_live | — |
| Marketing Incentives (leinsterappointments.ie) | November 26, 2024 | ransomware_live | — |
| Complete Recycling Services (completerecyclingservices.com) | November 26, 2024 | ransomware_live | — |
| Pinnacle Plastic Products (pinnacleplasitcporducts.com) | November 26, 2024 | ransomware_live | — |
| Pioneer Urban Land & Infrastructure (pioneerurban.in) | November 26, 2024 | ransomware_live | — |
| Fifteenfortyseven Critical Systems Realty (1547realty.com) | November 21, 2024 | ransomware_live | — |
| Hogan Mfg (hoganmfg.com) | November 21, 2024 | ransomware_live | — |
| Valley Planing Mill (valleyplaning.com) | November 19, 2024 | ransomware_live | — |
| Burkburnett Independent School District | November 19, 2024 | ransomware_live | — |
| Waters Truck and Tractor (waterstruck.com) | November 18, 2024 | ransomware_live | — |
| Vector Transport (vectortransport.com) | November 15, 2024 | ransomware_live | — |
| GSR Andrade Architects (gsr-andrade.com) | November 6, 2024 | ransomware_live | — |
| Cape Cod Regional Technical High School (capetech.us) | November 6, 2024 | ransomware_live | — |
| Askling Car (asklingbil.se) | October 31, 2024 | ransomware_live | — |
| SmartSource (smartsource-inc.com) | October 30, 2024 | ransomware_live | — |
| Jillamy (jillamy.com) | October 30, 2024 | ransomware_live | — |
| Sage Automotive Interior (sageautomotiveinteriors.com) | October 29, 2024 | ransomware_live | — |
| Jordan Public Schools (https://www.jordan.k12.mn.us/) | October 29, 2024 | ransomware_live | — |
| Evergreen Local School District (evgvikings.org) | October 25, 2024 | ransomware_live | — |
| Cucamonga Valley Water District (cvwdwater.com) | October 25, 2024 | ransomware_live | — |
| Evergreen SD50 (evergreensd50.com) | October 25, 2024 | ransomware_live | — |
| Apache Mills, Inc. (apachemills.com) | October 24, 2024 | ransomware_live | — |
| The Getz Group (getz.com.hk) | October 24, 2024 | ransomware_live | — |
| Value City NJ (valuecitynj.com) | October 24, 2024 | ransomware_live | — |
| Mar-Bal (mar-bal.com) | October 23, 2024 | ransomware_live | — |
| Goshen Central School District (gcsny.org) | October 23, 2024 | ransomware_live | — |
| Clear Connection (clearconnection.com) | October 22, 2024 | ransomware_live | — |
| Lincoln University (lincolnu.edu) | October 22, 2024 | ransomware_live | — |
| Trimarc Financial (trimarc.com) | October 21, 2024 | ransomware_live | — |
| Philadelphia Macaroni (philamacaroni.com) | October 21, 2024 | ransomware_live | — |
| Schweiger Transport (schweiger-gmbh.de) | October 21, 2024 | ransomware_live | — |
| Ultra Tune (ultratune.com.au) | October 18, 2024 | ransomware_live | — |
| Fromm (FrommBeauty.com) | October 18, 2024 | ransomware_live | — |
| Food Sciences Corporation (foodsciences.com) | October 16, 2024 | ransomware_live | — |
| Cordogan Clark and Associates (cordoganclark.com) | October 16, 2024 | ransomware_live | — |
| Welker (welker.com) | October 16, 2024 | ransomware_live | — |
| Central Pennsylvania Food Bank | October 15, 2024 | ransomware_live | — |
| Juice Generation | September 20, 2024 | ransomware_live | — |
| Sunrise Farms | September 19, 2024 | ransomware_live | — |
| Prentke Romich Company | September 18, 2024 | ransomware_live | — |
| Clatronic International GmbH | September 11, 2024 | ransomware_live | — |
| S. Walter Packaging | September 11, 2024 | ransomware_live | — |
| Seaway Manufacturing Corp. | August 15, 2024 | ransomware_live | — |
| Ziba Design | August 6, 2024 | ransomware_live | — |
| IOI Corporation Berhad | August 6, 2024 | ransomware_live | — |
| Hi-P International | August 5, 2024 | ransomware_live | — |
| BASF - Nunhems | July 29, 2024 | ransomware_live | — |
| City of Cold Lake | July 26, 2024 | ransomware_live | — |
| Odessa College | July 25, 2024 | ransomware_live | — |
| Wichita State University Campus of Applied Sciences and Technology | July 22, 2024 | ransomware_live | — |
| German University of Technology in Oman | July 16, 2024 | ransomware_live | — |
| West Allis-West Milwaukee School District | July 11, 2024 | ransomware_live | — |
| Djg Projects | July 7, 2024 | ransomware_live | — |
| Alvin Independent School District | July 4, 2024 | ransomware_live | — |
| Verweij Elektrotechniek | July 4, 2024 | ransomware_live | — |
| Asbury Theological Seminary | June 24, 2024 | ransomware_live | — |
| Geelong Lutheran College | June 19, 2024 | ransomware_live | — |
| Hochschule | September 28, 2023 | ransomware_live | — |
| USGS | July 12, 2023 | ransomware_live | — |
| Inet | December 20, 2021 | ransomware_live | — |
← NewerPage 2 of 2
Claim data from ransomware.live and RansomLook (CC BY 4.0).