Agilitas IT Solutions Limited Listed by donutleaks Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by pairing encryption with data theft and public leak-site listings, turning internal files into leverage. In this climate, even mid-sized technology firms appear on extortion portals with claims of exfiltrated material, leaving customers and partners to weigh unverified assertions against limited official detail.

On 19 September 2023, Agilitas IT Solutions Limited was listed by the group known as donutleaks. Public reporting describes internal files said to have been taken in a ransomware attack; the number of people affected remains unknown, and independent confirmation of the full scope has not been published.

What happened

According to the available record, Agilitas IT Solutions Limited appeared on the donutleaks leak site on or around 19 September 2023. The listing is accompanied by a message attributed to the group that asserts the victim had already seen a notice placed on its website and warns that continued silence would lead to the release of material described as source code and SQL databases exfiltrated from the company’s computer network. The same message claims a first package would contain 30 GB of source code and further data whose exact volume is truncated in the public summary.

No independent verification of the intrusion method, the precise date of initial access, or the total volume of data has been released in the facts at hand. The number of individuals whose information may be involved is recorded as unknown. The incident is therefore best understood as a claimed ransomware-related exfiltration whose technical particulars remain largely undisclosed.

Inside donutleaks

Donutleaks is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators encrypt systems and simultaneously copy data, then threaten to publish the stolen material on a dedicated leak site if payment is not made. Groups of this type typically post victim names, sample files or volume claims to increase pressure, and they often communicate through brief, imperfectly worded notices that assert prior contact with the organisation.

Public tracking of such actors shows they target a range of sectors, including technology and professional-services firms that hold source code, databases and internal documentation. Listings on their sites constitute claims by the group rather than confirmed disclosures; victims sometimes dispute the extent or sensitivity of what was taken, and law-enforcement or independent forensic reports are not always made public. In the present case, the facts supply only the group’s own wording about source code, SQL databases and an initial 30 GB package; no further verified statements from donutleaks specific to Agilitas beyond that listing are recorded here.

Who is Agilitas IT Solutions Limited?

Agilitas IT Solutions Limited is a United Kingdom-based technology company that provides IT services and solutions. Organisations of this kind typically design, host or support software systems for clients, manage infrastructure, and maintain repositories of source code, configuration data, internal documentation and customer or partner records. Because they sit between multiple businesses and their digital operations, a compromise can affect not only the firm’s own staff but also the confidentiality of client projects and any credentials or personal data processed in the course of service delivery.

A breach claim against an IT solutions provider therefore carries wider implications: source code may contain proprietary logic or embedded secrets, while databases can hold operational or personal information belonging to third parties. Even when the precise contents remain unconfirmed, the sector’s role as a custodian of technical and business data makes such incidents consequential for trust and contractual obligations.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack and that the group claims to hold source code and SQL databases, with a first package described as 30 GB of source code plus additional material. Exact file inventories, the presence or absence of personal data, and the identities of any affected individuals are not disclosed in the public record.

Companies in this sector commonly hold material such as:

• Source-code repositories and build artefacts
• Database dumps or SQL exports containing operational or client-related records
• Internal documents, configuration files and credentials used for system administration
• Correspondence or project files that may reference third-party organisations

Whether any of these categories were in fact taken, and in what volume beyond the group’s stated claim, remains unconfirmed. Readers should treat the listed data types as assertions by donutleaks rather than as independently verified contents.

Why it matters

For people whose information may have been stored in systems belonging to an IT services firm, the practical risks include potential misuse of credentials, exposure of project details that could enable further social-engineering attempts, and the longer-term possibility that fragments of personal or business data surface in secondary leaks. Because the number of affected individuals is unknown and the precise data types beyond “internal files,” source code and SQL databases are unconfirmed, the scale of personal impact cannot be quantified from public facts alone.

For the organisation itself, a public listing by a ransomware group can disrupt operations, trigger contractual notification duties, and require forensic investigation, system rebuilding and communication with clients. Even when encryption is reversed or systems are restored from backups, the existence of exfiltrated copies creates an ongoing confidentiality concern that is independent of whether a ransom is paid. The absence of detailed public disclosure does not eliminate these risks; it simply leaves affected parties with incomplete information on which to act.

Were you affected?

If you are a current or former client, partner or employee of Agilitas IT Solutions Limited, treat the incident as a prompt to review your own exposure rather than as proof that your specific data was taken. Practical first steps include changing passwords used on any systems connected to the company, enabling multi-factor authentication where available, monitoring financial and email accounts for unusual activity, and being alert to unsolicited messages that reference the firm or its projects.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Keep records of any notifications you receive from the organisation itself, and rely on official channels for confirmation rather than on unverified posts. Public detail on this incident remains limited; caution and basic hygiene are the proportionate response until more definitive information is released.

AICompiled with AI assistance from public sources and published under our editorial standards.