CORT Listed by kelvinsecurity Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 1, 2022, CORT was listed on a leak site maintained by the ransomware group kelvinsecurity. The entry states that internal files were taken during a ransomware operation, though the number of people affected and the precise contents of any data have not been publicly confirmed. The incident is known only through the group’s listing and its assertion that data was exfiltrated. No independent verification of the volume, type, or sensitivity of the material has been released, and the organization has not issued a detailed public statement on the event.

What happened

CORT was added to the kelvinsecurity ransomware leak site on April 1, 2022. The group claims to have stolen internal data during a ransomware attack. No information has been made public about the date of the intrusion itself, the method of initial access, the quantity of data involved, or whether any ransom demand was issued or met. The number of individuals whose information may have been affected is listed as unknown.

Who is kelvinsecurity?

Kelvinsecurity is a ransomware operation that maintains a public leak site to post names of organizations it claims to have targeted. Like other groups in this category, it typically encrypts systems and threatens to publish stolen files if payment is not received. The group has appeared in multiple public listings of ransomware incidents since its emergence, following the pattern of double-extortion tactics observed across several similar actors.

About CORT

CORT operates in the commercial and residential furniture rental sector, providing furnishings and related services to businesses and individuals. Organizations of this type routinely collect and store customer contact details, lease agreements, payment information, and internal operational records. A breach involving such an entity can therefore touch both personal data of clients and confidential business documents.

What was likely exposed

The only data category named in connection with the listing is internal files. No further breakdown of file types, record counts, or specific data fields has been disclosed. Organizations in this sector commonly hold customer names, addresses, financial details, and employee records, yet it is not confirmed whether any of these categories were among the material referenced in the leak-site claim.

Why it matters

Exposure of internal files can create risks of follow-on fraud, targeted phishing, or misuse of business information that may indirectly affect customers and staff. Because the scale and exact nature of the data remain unconfirmed, the practical consequences for any individual cannot be quantified from public sources. The incident also illustrates the ongoing pattern of ransomware groups using leak sites to pressure organizations regardless of whether files are ultimately published.

If your data was in this claimed breach

Monitor bank and credit accounts for unusual activity and consider placing a fraud alert with major credit bureaus. Change passwords for any accounts that may have been associated with CORT services and enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data sets to check for appearances in previously published records.

AICompiled with AI assistance from public sources and published under our editorial standards.