B&M - Expertise - Audit Listed by cicada3301 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional-services firms that hold concentrated volumes of client and internal records, using data theft as leverage alongside encryption. Listings on criminal leak sites have become a routine pressure tactic, even when independent verification of the claims remains limited.

On 18 July 2025 the ransomware group cicada3301 listed B&M – Expertise – Audit on its leak site, claiming to have exfiltrated 233 GB of internal files. The number of people affected is unknown, and public detail beyond the group’s own posting is sparse. The incident matters because audit and expertise practices routinely handle sensitive commercial and personal information whose exposure can create lasting risk for clients and staff.

Inside the incident

According to the listing published by cicada3301, the group claims to have conducted a ransomware attack against B&M and to have removed 233 GB of internal files. The posting, dated 18 July 2025, displayed a countdown status of 20 days, 19 hours, 47 minutes and 26 seconds at the time it was recorded. No further technical details—such as the initial access method, the specific systems compromised, or confirmation that encryption was deployed—have been disclosed in public sources. The volume of data and the assertion that internal files were exfiltrated rest solely on the group’s claim; independent corroboration has not been reported.

Who is cicada3301?

cicada3301 is a ransomware operation that maintains a dedicated leak site on which it publishes the names of organisations it claims to have attacked. Like other groups in this category, it typically combines data theft with encryption, then threatens to release the stolen material unless a ransom is paid. Public reporting on the group has documented a pattern of targeting mid-sized professional and commercial entities, advertising large data volumes, and using countdown timers to increase pressure. The group’s listing of any particular victim, including B&M, remains an unverified claim unless separately confirmed by the organisation or by forensic investigators. No statements attributed to cicada3301 beyond the basic listing details for this incident are available in the public record.

About B&M

B&M operates in the audit and professional-expertise sector. Firms of this type provide financial audit, compliance, and advisory services to corporate and institutional clients. In the course of that work they typically hold client financial statements, working papers, correspondence, employee records, and other confidential commercial information. A breach at such an organisation is consequential because the data often include material that is both commercially sensitive and subject to regulatory confidentiality obligations. Exposure can affect not only the firm itself but also the clients whose information is held in trust.

What data was at risk

The only data description supplied by the listing is “internal files” said to have been exfiltrated in a ransomware attack, with a claimed volume of 233 GB. No further breakdown—such as whether the files contained personal data, client records, credentials, or financial documents—has been disclosed. Organisations in the audit and expertise sector commonly store precisely those categories of information. Because the exact contents remain unconfirmed, it is not possible to state with certainty what specific records were taken. The scale claimed by the group is large enough to encompass substantial volumes of working papers and internal documentation, but that remains an assertion rather than verified fact.

Why it matters

For individuals whose data may have been among the internal files, the practical risks include identity misuse, targeted phishing that references genuine commercial relationships, and potential secondary fraud. For B&M and its clients, the consequences can include regulatory notification duties, contractual liability, and erosion of the confidentiality on which professional-services relationships depend. Even when the precise contents of a claimed data set are unknown, the mere assertion of large-scale exfiltration creates uncertainty that organisations and affected parties must manage. Recovery costs, legal exposure, and reputational damage are typical outcomes in such cases, independent of whether a ransom is paid.

Were you affected?

If you are a client, employee, or partner of B&M, monitor official communications from the firm for any confirmation or guidance. Change passwords on accounts that may have been linked to the organisation, enable multi-factor authentication where available, and remain alert for unsolicited messages that appear to reference audit or advisory work. Because the number of people affected is unknown and the exact data types are unconfirmed, a free exposure scan of your email address against known breach data sets can provide an early indication of whether your information has already appeared in public dumps. Keep records of any suspicious activity and report it to the relevant authorities if fraud is suspected.

AICompiled with AI assistance from public sources and published under our editorial standards.