ARM Listed by D1R Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 13, 2026, the ransomware group D1R listed ARM on a leak site and stated that internal files had been taken from the company. The number of people whose information may be involved remains unknown, and no confirmation of the scale or contents of any exfiltration has been made public. The practical stakes for individuals and partners connected to ARM centre on whether any of the claimed files contain contact details, credentials or design-related material that could be used for further targeting or misuse.

Inside the incident

The incident was reported on 13 July 2026 when D1R placed ARM on its leak-site listing. The group claims the files were obtained after access to an ARM centre was gained through information from a previously leaked Synopsys database. It states that other leaks were cross-referenced to locate the target and that an SSL certificate belonging to a company that owns ARM products was used to download a tool called Athena Download Manager. The group further claims this tool allowed files to be obtained while bypassing some multi-factor authentication steps required on the public ARM site. No independent verification of these claims or of the volume of data taken has been published.

Who is D1R?

D1R is a ransomware group that maintains a leak site to publish names of organisations it claims to have targeted. Such groups commonly list victims to pressure them into payment negotiations. The listing for ARM constitutes the group’s claim of access; no separate confirmation from ARM or law-enforcement sources has been referenced in available reporting.

Who is ARM?

ARM designs processor architectures and licenses intellectual property used in a wide range of computing devices. Organisations in this sector routinely hold design specifications, partner agreements, internal tooling and contact information for customers and suppliers. A claim of access to such material is consequential because the designs and processes involved underpin products used across consumer electronics, automotive systems and infrastructure.

What data was at risk

The only data type named in the listing is internal files exfiltrated during a ransomware attack. No inventory of specific file categories, record counts or affected individuals has been released. Organisations of this type commonly store engineering documents, authentication materials and partner data, yet the precise contents of any exfiltrated material remain unconfirmed.

Why it matters

Exposure of internal files can create downstream risks for organisations that rely on ARM technology, including the potential reuse of any obtained credentials or design information. For individuals, the main concern is whether any personal or account-related data appears among the claimed files. At present the absence of Reported Details limits the ability to assess the full scope of impact on either group.

Were you affected?

ARM has not published a notification process for individuals. Practical first steps include monitoring official statements from the company and changing passwords for any ARM-related accounts. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

• Review account activity on any services linked to ARM or its partners.
• Enable or strengthen multi-factor authentication where available.
• Watch for official updates from ARM on the status of the claimed incident.

AICompiled with AI assistance from public sources and published under our editorial standards.