Array Networks Listed by dunghill Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target technology suppliers whose products sit inside enterprise and government networks, turning a single intrusion into a potential supply-chain problem. In this climate, even a listing on a leak site can raise immediate questions for customers who rely on the vendor’s encryption and access tools.

On 29 February 2024 Array Networks, an American networking hardware company, appeared on a site operated by the ransomware group dunghill. The group claims it exfiltrated internal files during a ransomware attack. Public detail remains limited: the number of people affected is unknown, and no further inventory of the stolen material has been released.

Breaking down the breach

The only confirmed public information is that Array Networks was listed by dunghill on or around 29 February 2024. The listing asserts that internal files were taken as part of a ransomware incident. No technical description of the initial access method, no timeline of the intrusion, and no statement confirming or denying the claim have been published by the company or by independent investigators. The scale of any data loss and the precise contents of the files remain undisclosed.

The group behind it: dunghill

Dunghill is a ransomware operation that follows the now-common double-extortion model: encrypt systems and simultaneously claim to have stolen data, then threaten to publish the material on a dedicated leak site if a ransom is not paid. Like other groups of this type, it posts victim names and sample files to pressure organisations into negotiation. Public reporting on dunghill has described typical ransomware tactics—phishing or exploitation of remote-access services followed by lateral movement and data staging—but no independent verification of the specific claims made against Array Networks has been released. The listing itself should therefore be treated as an unverified assertion by the group.

About Array Networks

Array Networks is a networking hardware vendor founded in 2000 by Lawrence Lu and headquartered in Milpitas, California. It develops appliances and software for secure remote access, application delivery and network traffic encryption, including SSL VPN products. The company received early funding from U.S. Venture Partners and H&Q Asia Pacific. In May 2009 it became the first non-Taiwanese firm listed on the Taiwan Stock Exchange, selling 54 million shares valued at approximately 79 million dollars. At that time a substantial share of its market was in China. Organisations of this kind typically maintain customer lists, product configuration data, source-code repositories, internal engineering documents and employee records—information that, if exposed, could affect both the vendor and its clients.

What was likely exposed

The only data category named in the public record is “internal files” said to have been exfiltrated. No further breakdown—whether source code, customer contracts, employee data, financial records or configuration files—has been disclosed. Networking and security vendors commonly hold proprietary firmware, customer deployment details, support tickets and authentication credentials for their own systems. Because the exact contents remain unconfirmed, any assessment of what was taken must stay at this general level.

Why it matters

For individuals whose contact or employment details may have been among the files, the practical risks include targeted phishing and credential-stuffing attempts that reference the company. For Array Networks itself, the exposure of internal engineering or customer-related material could assist further attacks on its products or on organisations that use them. Customers who rely on Array’s SSL VPN and encryption appliances may also face secondary concerns about whether any of their own configuration data or support information was present. Until a fuller inventory is published, the precise scope of these risks cannot be quantified.

What to do if you're exposed

Anyone who has worked with or for Array Networks should treat unsolicited messages that reference the company with caution, enable multi-factor authentication on personal and work accounts, and monitor financial and credit activity for unusual behaviour. Changing passwords that may have been reused across services is a prudent first step. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan does not confirm involvement in this specific incident but can surface other exposures that warrant attention.

AICompiled with AI assistance from public sources and published under our editorial standards.