Agaris Listed by worldleaks Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Agaris, a Belgium-based company that produces growing media for the horticulture industry and operates in more than 60 countries, has been listed by the worldleaks ransomware group. The listing was reported on 3 May 2025. Public detail remains limited: the number of people affected is unknown, and the only confirmed description of the material is that internal files were allegedly exfiltrated in a ransomware attack.

Because Agaris supplies substrates, landscaping materials and raw materials used by professional growers worldwide, any compromise of its internal systems raises questions about operational continuity and the security of business data held by a firm that sits inside global food and plant production chains.

Inside the incident

According to the available record, Agaris appears on a worldleaks leak-site listing dated 3 May 2025. The group claims that internal files were taken during a ransomware attack. No further technical details—such as the initial access method, the exact date of intrusion, the volume of data removed, or whether encryption was also deployed—have been disclosed in the public summary. The number of individuals whose information may have been involved is listed as unknown. At present the listing itself constitutes an unverified claim by the threat actor rather than an independently confirmed breach report from the company.

Who is worldleaks?

worldleaks is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators exfiltrate data and then encrypt systems, threatening to publish the stolen material on a dedicated leak site if a ransom is not paid. Like other groups in this category, worldleaks typically posts victim names, sample files and countdown timers to increase pressure. Public reporting on the group has documented prior listings of organisations across manufacturing, logistics and professional services. In the present case the only statement that can be attributed to worldleaks is its claim that Agaris’s internal files were exfiltrated; no additional assertions by the group about this specific victim appear in the available facts.

Agaris and its sector

Agaris specialises in growing-media production for professional horticulture. Its product range covers substrates for commercial growers, landscaping solutions and raw materials intended to support healthy plant and food production. Headquartered in Belgium, the company maintains operations across more than 60 countries. Firms of this type routinely hold supplier contracts, production formulas, logistics data, customer lists, employee records and financial information. Because the horticulture supply chain feeds into food production and landscaping markets, a disruption or data exposure at a major media producer can affect growers, distributors and end customers who rely on consistent, quality-controlled inputs.

What data was at risk

The public record states only that “internal files” were exfiltrated. No inventory of those files—whether they contain employee personal data, customer contracts, proprietary formulations, financial records or other categories—has been released. Organisations in the growing-media sector typically store a mixture of commercial, operational and personal information; however, the precise contents of the material claimed by worldleaks remain unconfirmed. The number of people potentially affected is also unknown.

The real-world impact

For individuals whose details may reside inside the exfiltrated files, the practical risks include possible phishing or social-engineering attempts that leverage any exposed names, email addresses or business relationships. For Agaris itself, the consequences can include temporary operational disruption, the cost of forensic investigation and system recovery, and reputational pressure from customers and partners who depend on the integrity of its supply chain. Because the company operates internationally, any confirmed compromise could also trigger notification obligations under multiple data-protection regimes. At this stage these remain potential rather than documented outcomes, given that the scale and exact nature of the data remain undisclosed.

Were you affected?

If you have a business or employment relationship with Agaris, treat any unexpected communications that reference the company with caution until more official information appears. Practical first steps include:

• Monitor financial and email accounts for unusual activity.
• Enable multi-factor authentication on accounts that may have been linked to Agaris systems.
• Change passwords for any shared or work-related credentials you used with the company.
• Watch for phishing messages that attempt to exploit knowledge of the incident.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official confirmation from Agaris or regulators, if and when it is issued, will provide the most reliable guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.