COSI Listed by karakurt Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by pairing system disruption with the threat of public data leaks, a pattern that has become a fixture of the modern cyber-threat landscape. Museums, science centres and other cultural institutions are not immune; they hold donor records, staff details and operational files that can be valuable to attackers and harmful if misused. In early August 2023, the group known as karakurt publicly listed COSI, Columbus’s Center of Science and Industry, among its claimed victims.

According to that listing, the group said it had taken roughly 75 GB of internal material and threatened release. The number of people affected remains unknown, and independent confirmation of the full scope has not been published in the available record. For anyone connected to COSI—as a visitor, donor, partner or employee—the claim raises practical questions about what may have been copied and what steps are worth taking now.

What happened

On or around 2 August 2023, karakurt listed COSI on its leak site. The group described the incident as a ransomware attack in which internal files were allegedly exfiltrated. In its own wording it stated that it had taken about 75 GB of data and listed categories it claimed to hold: project information, accounting and financial documents, contracts (some described as confidential), client contacts, donations information, databases containing client, partner and employee data, transactions and correspondence. It added that a release would follow.

Public detail beyond that listing is limited. The precise date of initial access, the technical method used, whether encryption was also deployed, and whether any ransom demand was paid or negotiations occurred are not disclosed in the available facts. The number of individuals whose information may be involved is likewise unknown. The leak-site entry should be treated as an unverified claim by the group unless and until further confirmation appears.

Who is karakurt?

Karakurt is a ransomware and data-extortion operation that became widely known in the early 2020s. Unlike some ransomware brands that focus primarily on locking systems, karakurt has frequently emphasised theft and the threat of publication. The group typically posts victim names on a dedicated leak site, accompanies listings with descriptions of stolen data, and sets deadlines before dumping files. It has been associated with attacks across multiple sectors and geographies, often after initial access obtained through compromised credentials, phishing or exploitation of remote-access services.

Public reporting has linked karakurt’s tactics to double-extortion style pressure: organisations face both operational disruption and the reputational and regulatory risk of sensitive material appearing online. The group’s statements about any specific victim, including COSI, remain claims until corroborated by the organisation, law enforcement or independent forensic disclosure. Nothing in the present record confirms that karakurt’s description of the COSI haul has been independently verified in full.

About COSI

COSI—the Center of Science and Industry—is a well-known science museum and educational centre in Columbus, Ohio. Institutions of this kind combine public exhibition spaces with education programmes, membership and ticketing systems, donor and fundraising operations, corporate partnerships, and the ordinary back-office functions of a sizable nonprofit or cultural organisation. They routinely hold staff and volunteer records, donor and membership databases, financial and accounting files, contracts with vendors and partners, and project or programme documentation.

A breach affecting such an organisation matters because the data often mixes publicly facing visitor information with more sensitive internal material—payroll or HR files, donation histories, confidential contracts and correspondence. Even when the primary mission is education and public engagement, the supporting administrative systems can contain personal and financial details that, if exposed, create lasting risk for individuals and for the institution’s ability to operate and fundraise with trust.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. Karakurt’s listing specifically claimed roughly 75 GB containing project information, accounting and financial documents, contracts (some confidential), client contacts, donations information, and databases with client, partner and employee data, plus transactions and correspondence. Those categories come from the group’s own description and are not independently confirmed in the available record.

Exact contents, file inventories and the identities of any affected individuals remain unconfirmed publicly. Organisations like COSI typically maintain employee and payroll data, donor and membership records, vendor and partner contact lists, financial ledgers, and operational correspondence. It is reasonable to expect that material of those general types could be in scope if the group’s claims are accurate, but readers should not treat any specific document or personal record as verified fact solely on the basis of the leak-site post. The number of people affected is unknown.

What's at stake

For individuals, the concrete risks depend on what was actually copied. Employee or partner data can enable targeted phishing, identity fraud or credential stuffing. Donor and financial information can be misused for scams that impersonate the organisation or for attempts to exploit payment details. Contracts and internal correspondence, if genuine and released, can expose commercial terms, negotiation positions or personal remarks that were never intended for public view.

For COSI itself, the stakes include potential regulatory notification duties, costs of investigation and remediation, strain on donor and partner relationships, and the longer-term work of restoring confidence. Even when systems are restored, the possibility that copies of sensitive files remain in criminal hands can linger. None of this establishes negligence on the organisation’s part; it simply describes the ordinary consequences that follow when internal data is claimed to have left an organisation’s control.

Were you affected?

If you are a current or former employee, donor, member, partner or contractor of COSI, treat the karakurt claim as a reason for heightened caution rather than proof that your specific records were taken. Monitor financial and email accounts for unusual activity, be sceptical of unexpected messages that reference COSI, donations or outstanding payments, and consider placing fraud alerts with credit bureaus if you believe sensitive personal data may have been involved. Official notices from COSI, if issued, should take priority over third-party summaries.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step does not confirm or rule out involvement in this specific incident, but it can surface credentials or personal details that have circulated elsewhere and deserve attention. Stay alert to further verified statements from the organisation or from authorities as more detail, if any, becomes public.

AICompiled with AI assistance from public sources and published under our editorial standards.