Cocal Listed by avaddon Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 9, 2021, the name Cocal appeared on a leak site operated by the Avaddon ransomware group. The listing indicated that internal files had been taken from the organisation during a ransomware incident. The number of individuals whose information may be involved remains unknown, and no further details about the scale or contents of the data have been made public. This development matters because organisations routinely store records that can affect employees, partners, or customers. When such material surfaces in connection with a ransomware operation, the practical question is what exactly was taken and whether it can be used for further harm.

What happened

Cocal was listed on the Avaddon ransomware leak site on September 9, 2021. The group claims to have stolen internal data during a ransomware attack. No confirmed count of affected people, no list of specific file types, and no timeline of the intrusion itself have been disclosed by either the organisation or the group.

Who is avaddon?

Avaddon operated as a ransomware-as-a-service group that used a double-extortion approach: it encrypted systems on victim networks and threatened to publish stolen files if a ransom was not paid. The group maintained a public leak site where it posted the names of organisations it claimed to have compromised. Avaddon was active from roughly 2020 until mid-2021, when its infrastructure was dismantled.

Cocal and its sector

Cocal is an organisation that maintains internal operational records. Entities of this kind typically hold documents related to business processes, personnel, contracts, and technical systems. A breach that exposes such material can create downstream consequences for the organisation’s operations and for any individuals referenced in the files.

The information in question

The only detail released is that internal files were allegedly exfiltrated. The precise categories of data contained in those files have not been confirmed. Organisations in this position commonly store employee records, financial documents, and correspondence; however, whether any of these categories were actually taken in this case remains unverified.

What's at stake

Exposed internal files can contain information that is later used for targeted fraud, social-engineering attacks, or further criminal activity. For the organisation, the incident may lead to operational disruption, regulatory scrutiny, and costs associated with investigation and remediation. Individuals named in the records face the possibility that their personal or professional details could be misused, though the likelihood depends on the actual contents, which are not yet known.

Were you affected?

Because the number of people involved and the nature of the files have not been published, it is not currently possible to determine exposure from official statements alone. Individuals can check whether their email address appears in known breach datasets through free public lookup services. Anyone who believes their information may be involved should monitor accounts for unusual activity and consider contacting Cocal directly for any updates the organisation may release.

AICompiled with AI assistance from public sources and published under our editorial standards.