COREBI(NowVertical) Listed by arcusmedia Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 14, 2026, the ransomware group arcusmedia listed COREBI(NowVertical) on its leak site and claimed to have carried out a ransomware attack that included the exfiltration of internal files. The number of individuals affected remains unknown, and no independent confirmation of the data volume or contents has been made public. The incident adds to the pattern of ransomware operators targeting organisations that manage large volumes of commercial and analytical data.

Inside the incident

The listing appeared on July 14, 2026. The only details released by the group are that internal files were taken during a ransomware operation. No figure for records or files has been stated, and the organisation has not issued a public statement confirming or denying the claims. Timing of the initial access, encryption, or any ransom demand is not disclosed in available reporting.

Inside arcusmedia

Arcusmedia is a ransomware operator that maintains a leak site to publicise claimed victims. Groups of this type typically gain initial access through phishing, exposed remote services, or compromised credentials, then move laterally to locate and exfiltrate data before deploying encryption. Their public listings serve as pressure on victims to negotiate. The group’s claim regarding COREBI(NowVertical) follows this established pattern but remains an unverified assertion at this stage.

COREBI(NowVertical) and its sector

COREBI(NowVertical) operates as a global data and AI company focused on transforming organisational data into usable business outputs. Companies in this sector routinely process customer records, operational metrics, proprietary models, and partner information. A successful intrusion at such a firm can expose both the organisation’s internal processes and any third-party data it holds under contract.

What was likely exposed

The group states that internal files were exfiltrated. No further breakdown of file categories, record counts, or data sensitivity has been provided. Organisations of this type commonly store client datasets, analytical models, employee records, and contractual documents, yet the precise contents of any exfiltrated material remain unconfirmed.

What's at stake

Individuals whose information appears in the exfiltrated files could face risks of targeted phishing or account misuse if credentials or contact details are present. The organisation itself may encounter regulatory scrutiny, contractual liabilities, and operational disruption while assessing and containing the incident. Because the scale of exposure is undisclosed, the full extent of downstream effects cannot yet be measured.

Were you affected?

Individuals can begin by monitoring their email accounts for unusual login attempts and enabling multi-factor authentication on services that hold personal or financial data. Checking credit reports and account statements for anomalies provides an additional layer of early detection.

• Review any recent notifications from NowVertical or its partners.
• Run a free exposure scan using a reputable breach-checking service with your email address.
• Change passwords for any accounts that may share credentials with services linked to the organisation.
• Remain alert for unsolicited messages that reference the company or its services.

AICompiled with AI assistance from public sources and published under our editorial standards.