CloudCall Listed by vicesociety Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that manages cloud and IT services for other businesses appears on a ransomware group's leak site, the practical concern is straightforward: internal files may have left the organisation's control, and people connected to that business — staff, clients, or partners — cannot yet know how far the exposure reaches. Public reporting on 23 January 2023 stated that CloudCall had been listed by the Vice Society ransomware group, with internal files described as exfiltrated. The number of people affected remains unknown, and independent confirmation of the full scope has not been laid out in the available record.

For anyone who works with or relies on CloudCall's services, that uncertainty is the immediate stake. Ransomware listings are claims until verified; still, the pattern of such incidents means affected individuals are wise to treat the possibility of exposed internal material seriously and to take basic protective steps while fuller detail is lacking.

Breaking down the breach

According to the public report dated 23 January 2023, CloudCall was listed by the Vice Society ransomware group. The available summary states that internal files were exfiltrated in a ransomware attack. No figure has been given for the number of people affected. Timing of the intrusion itself, the precise method of initial access, the volume of data taken, and whether encryption was also deployed are not disclosed in the facts at hand. What is on record is the group's listing of the organisation and the characterisation of the incident as involving exfiltration of internal files.

Because the listing originates with the threat actor, it should be read as a claim rather than as independently verified proof of every asserted detail. Organisations named on ransomware leak sites sometimes confirm, partially confirm, or contest such claims later; in this case the public record supplied here does not include a detailed victim statement or a confirmed headcount of affected individuals.

Who is vicesociety?

Vice Society is a ransomware group that became widely known for double-extortion operations: stealing data and threatening to publish it, often alongside or instead of encrypting systems. The group has historically favoured targets in sectors such as education, healthcare, and other organisations holding substantial internal records, and it has used leak sites to pressure victims by posting samples or full archives when ransoms are not paid. Its operators have been associated with established ransomware strains and with relatively opportunistic targeting rather than highly selective, long-term intrusion campaigns against a single industry alone.

Public reporting over several years has documented Vice Society's pattern of claiming breaches, naming victims on its leak infrastructure, and releasing data when negotiations fail. That background explains why a listing carries weight as a warning signal even when the victim has not yet published a full incident report. It does not, however, automatically confirm every detail the group may assert about any single victim. In the CloudCall case, the facts state only that the organisation was listed and that internal files were described as exfiltrated; no further specific claims by the group about this victim are provided here.

About CloudCall

CloudCall presents itself as a provider of cloud solutions aimed at small and medium-sized businesses, with a focus on simplifying IT environments so that client organisations can concentrate on their core work. Firms in this sector typically supply or manage communications, collaboration, hosting, or related cloud infrastructure and support. They often sit in a trusted position: they may hold administrative access, configuration data, contact records, and operational information belonging both to their own staff and to the businesses they serve.

A breach involving a cloud or managed-IT provider is consequential precisely because of that intermediary role. Internal files at such a company can include material that is sensitive not only to the provider but to its customers. Even when the exact contents of a theft remain unconfirmed, the sector context explains why listings of this kind draw attention from clients, partners, and individuals whose details may have been stored in the provider's systems.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown — such as whether the files included customer databases, employee records, credentials, financial documents, or technical configurations — is supplied. The number of people affected is unknown.

Organisations that deliver cloud and IT services to small and medium businesses commonly hold staff directories, client contact and contract information, system documentation, support tickets, and credentials or keys used to administer customer environments. That is typical of the sector; it is not a confirmed inventory of what was allegedly taken from CloudCall. Exact contents remain unconfirmed, and no public tally of affected individuals has been given in the available record. Readers should therefore treat any assumption about specific data types as speculative until official clarification appears.

Why it matters

For individuals, the real-world risk depends on what the internal files actually contained. If employee or customer personal data were among them, possible outcomes include targeted phishing, identity misuse, or credential stuffing against other accounts. If technical or client-environment information were included, customers of the provider could face secondary risk even if their own systems were not directly breached. Because the scale and contents are undisclosed, these remain possibilities rather than established facts; the responsible response is caution, not panic.

For the organisation, a ransomware-related listing can damage trust with clients who rely on it to safeguard their IT environments, invite regulatory scrutiny where personal data may be involved, and create operational and legal costs associated with investigation and notification. None of that requires assuming negligence; ransomware groups routinely exploit common vulnerabilities and stolen credentials across many well-resourced victims. The concrete issue is the combination of claimed exfiltration, an unknown affected population, and the trusted position CloudCall occupies for small and medium businesses.

What to do if you're exposed

If you are a current or former employee, client contact, or partner of CloudCall, begin with ordinary hygiene: monitor bank and account statements, treat unexpected emails or calls that reference the company with scepticism, and change passwords on any accounts that may have shared credentials or recovery details with work systems. Enable multi-factor authentication where it is available. If you receive notification from the company, follow its instructions and use only official channels to verify them.

Because the full contents of the exfiltrated files are unconfirmed and the number of people affected is unknown, checking whether your own email address has already appeared in known breach datasets is a practical next step. You can run a free exposure scan of your email to see whether your information has surfaced in documented breach data and then prioritise further protections accordingly.

AICompiled with AI assistance from public sources and published under our editorial standards.