AJ Networks Listed by AiLock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

AJ Networks, a South Korea-based rental company, has been listed by the AiLock ransomware group as a victim of a data-exfiltration attack. Public reporting on 17 April 2025 indicates that internal files were taken, though the number of people affected remains unknown and further technical details have not been released.

The listing itself is a claim by the group rather than independent confirmation. For customers, partners and employees of a firm that handles equipment rentals and related business records, any confirmed exposure of internal files raises practical questions about what information may now be in unauthorised hands and what steps are warranted.

What happened

According to the available record, AJ Networks Co. Ltd was named on AiLock’s leak site in connection with a ransomware attack that involved the exfiltration of internal files. The incident was reported on 17 April 2025. No public figure has been given for the volume of data taken, the precise date of intrusion, the initial access method, or the number of individuals whose information may be involved. Those particulars remain undisclosed.

Ransomware operations of this type typically combine encryption of systems with theft of data, after which the operators threaten to publish the material unless a payment is made. In this case the only concrete assertion in the public record is the group’s claim that internal files belonging to AJ Networks were removed. Independent verification of that claim, or of any subsequent publication of the files, has not been supplied in the facts available.

The group behind it: AiLock

AiLock is a ransomware operation that has appeared in public threat-intelligence reporting as a group that conducts double-extortion attacks. Like many contemporary ransomware actors, it is known to gain access to corporate networks, exfiltrate data, encrypt systems, and then list victims on a dedicated leak site while demanding payment. The group’s public postings are claims; they do not by themselves constitute forensic confirmation that a breach occurred or that the stated volume of data was taken.

Prior activity attributed to AiLock has followed the familiar pattern of targeting mid-sized and larger organisations across multiple sectors, using the threat of data release as leverage. No specific statements by AiLock about AJ Networks beyond the listing itself are recorded in the facts provided, so any further characterisation of the group’s demands or timelines in this particular case would be speculative.

Who is AJ Networks?

AJ Networks Co. Ltd is described as operating in the “Other Rental Stores” category, covering furniture, audio-visual equipment, and construction and industrial equipment. The company is headquartered in Seoul, South Korea, employs between 500 and 999 people, and reports annual revenue in the range of 500 million to 1 billion (currency unit as given in the source summary). Organisations of this type typically maintain customer contracts, equipment inventories, payment records, employee data, and supplier agreements.

A breach at a rental firm of this scale can affect not only the company’s own operations but also the commercial and personal information of clients who rent equipment, of staff who work there, and of business partners who supply or service the inventory. Because the firm sits at the intersection of consumer and industrial rental markets, the potential reach of any compromised internal files is correspondingly broad, even though the exact contents remain unconfirmed.

The information in question

The only data category named in the public record is “internal files exfiltrated in ransomware attack.” No further breakdown—such as customer lists, financial documents, employee records, or technical schematics—has been disclosed. Organisations that rent furniture, A/V gear and construction equipment ordinarily hold contracts, identity and contact details of customers, payment and credit information, employee personnel files, and operational documents related to inventory and logistics. Whether any of those categories were among the files taken in this incident is unconfirmed.

Until more precise inventories are published by the company or by independent investigators, it is not possible to state with certainty what specific records left AJ Networks’ control. The group’s claim of exfiltration should therefore be treated as an allegation pending verification.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include possible misuse of contact details for phishing or social-engineering attempts, exposure of contractual or financial data that could facilitate fraud, and, if employee records were involved, the compromise of personal identifiers. For the organisation itself, the stakes include operational disruption, potential regulatory scrutiny under South Korean data-protection rules, reputational damage with customers and partners, and the cost of investigation and remediation.

Because the number of people affected is unknown and the precise file types are undisclosed, the scale of these risks cannot yet be quantified. The absence of Reported Details does not eliminate the need for caution; it simply means that responses must be based on prudent assumptions rather than on a verified inventory of lost data.

If your data was in this claimed breach

If you have done business with AJ Networks, worked for the company, or otherwise supplied personal or commercial information to it, the following steps are advisable while further details remain limited:

• Monitor financial accounts and credit reports for unexpected activity and consider placing a fraud alert if you believe sensitive identifiers may have been involved.
• Treat unsolicited emails, calls or messages that reference AJ Networks or equipment rentals with heightened suspicion; verify any request through official channels before responding.
• Change passwords on accounts that may have shared credentials or personal details with the company, and enable multi-factor authentication where available.
• Retain copies of any correspondence or contracts you hold with AJ Networks so you can identify what information the firm possessed about you.
• Run a free exposure scan of your email address against known breach datasets to check whether your information has already appeared in other public leaks; this can help you prioritise further protective measures.

Public detail on this incident remains limited. Continue to watch for official statements from AJ Networks or from relevant South Korean authorities, and adjust your response as confirmed information becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.