Acomen Listed by noescape Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized organisations across healthcare-adjacent sectors, where operational disruption and the theft of internal records can create lasting pressure. In this environment, listings on criminal leak sites have become a common way for attackers to assert control and force negotiations, even when independent confirmation remains limited.

On July 18, 2023, the ransomware group known as noescape listed Acomen, a company in the health, wellness and fitness industry. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected is unknown, and many operational details have not been disclosed. The listing itself constitutes a claim by the group rather than independently verified proof of every asserted detail.

Breaking down the breach

According to available public information, Acomen appeared on noescape’s leak site on or around July 18, 2023. The reported summary indicates that internal files were taken during a ransomware attack. No confirmed figure has been released for the number of individuals whose information may have been involved, and specifics such as the precise intrusion method, the duration of unauthorised access, or the full volume of data removed have not been made public.

In ransomware incidents of this type, attackers typically encrypt systems to halt normal operations while simultaneously copying data for leverage. Here, the only data description provided is that internal files were allegedly exfiltrated. Whether encryption also occurred, whether a ransom demand was issued, or whether any negotiation took place remains undisclosed. Because the primary source is the group’s own listing, the incident should be treated as an asserted claim pending further corroboration from the organisation or independent investigators.

The group behind it: noescape

Noescape is a ransomware operation that emerged in the threat landscape as a ransomware-as-a-service style group, known for double-extortion tactics. In well-documented public reporting, such groups typically gain initial access through phishing, exploited vulnerabilities, or compromised credentials, then move laterally, exfiltrate data, and deploy encryption. They maintain leak sites where they name victims and sometimes publish samples or full archives if payment is not received.

Noescape has been observed claiming responsibility for attacks on organisations of varying sizes across multiple sectors. Its public postings generally serve both as pressure on the victim and as advertising to affiliates. For the Acomen listing specifically, the group claims the company was compromised and that internal files were taken; no additional statements from noescape about this particular victim—such as sample file names, ransom amounts, or deadlines—are included in the available facts. Those claims therefore stand as the group’s assertions rather than independently established facts.

Who is Acomen?

Acomen operates in the health, wellness and fitness industry. Public business information places it in the small-to-mid-market range, with roughly 21 to 50 employees and estimated revenue between $5 million and $10 million. Organisations in this sector commonly manage customer accounts, membership or appointment systems, employee records, billing information, and sometimes health-related or lifestyle data collected through apps, wearables, or in-person services.

A breach affecting a company of this profile matters because even modest-sized operators can hold concentrated sets of personal and operational information. Customers and staff may have limited visibility into how their data is stored, and smaller firms often have fewer dedicated security resources than large enterprises. The consequences extend beyond the organisation itself to anyone whose details appear in internal files, correspondence, or systems that support day-to-day services.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown—such as customer databases, employee records, financial documents, or health-related information—has been publicly named. Exact contents therefore remain unconfirmed.

Companies in the health, wellness and fitness space typically maintain records that can include names, contact details, payment or membership information, appointment histories, and internal business documents such as contracts, emails, and operational plans. Some may also process limited health or fitness metrics. Because the specific files allegedly taken from Acomen have not been itemised in the available reporting, it is not possible to state which of these categories, if any, were involved. Readers should treat any assumption about particular data types as speculative until official confirmation appears.

The real-world impact

For individuals, the primary risks centre on the potential misuse of personal information that may have been present in internal files. This can include targeted phishing that references real relationships or services, attempts at identity fraud if identifiers were present, or unwanted contact. Because the scale of exposure is unknown, people connected to Acomen—customers, former customers, employees, or partners—cannot yet gauge their individual level of risk with precision.

For the organisation, a ransomware incident that includes data theft can disrupt operations, damage trust, and create regulatory or contractual obligations depending on the jurisdictions and data types involved. Recovery often requires system restoration, forensic review, and communication with affected parties. Even when encryption is reversed or systems are rebuilt, the existence of copied internal files outside the organisation’s control can prolong concern. Public detail on whether Acomen experienced prolonged outages or issued formal notifications remains limited.

What to do if you're exposed

If you have a past or present relationship with Acomen, treat the situation as a prompt for basic hygiene rather than panic. Monitor financial and account statements for unfamiliar activity, and be cautious of unexpected emails or messages that reference the company or request urgent action. Consider changing passwords for any accounts that reused credentials potentially linked to workplace or service logins, and enable multi-factor authentication where available. If you receive notification directly from Acomen, follow the guidance it provides.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach datasets. Remaining alert to phishing and keeping personal records organised will help you respond quickly if further details about this incident become public.

AICompiled with AI assistance from public sources and published under our editorial standards.