d2go.io Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a technology firm that builds deep-learning systems for edge devices appears on a ransomware group's leak site, the immediate concern is not abstract. Employees, contractors, partners and customers whose information may sit inside internal files face the practical risk that those records could be published or sold. On 10 February 2025 the ransomware group known as clop claimed to have listed d2go.io, stating that internal files had been exfiltrated. The number of people affected remains unknown, and public detail about the precise contents is limited.

For anyone who has worked with or supplied data to an organisation of this type, the listing raises concrete questions about what may now be outside the company's control and what steps are worth taking while fuller information is still scarce.

Breaking down the breach

According to the available record, d2go.io was listed by the clop ransomware group on 10 February 2025. The group claims that internal files were exfiltrated in a ransomware attack. No figure has been given for the number of people affected, no specific file names or volumes have been published in the public summary, and the method of initial access has not been disclosed. Public reporting therefore consists of the listing itself and the description of the data as internal files taken during a ransomware incident. Whether the claim has been independently verified, whether a ransom was demanded or paid, and whether any data has actually been released remain unconfirmed in the material provided.

Inside clop

Clop is a well-documented ransomware operation that has been active for several years. The group is known for double-extortion tactics: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. Clop has previously claimed responsibility for high-profile campaigns that exploited vulnerabilities in widely used file-transfer software and has listed dozens of organisations across manufacturing, finance, healthcare and technology. Its public statements are claims rather than Reported Facts; listings on its site are therefore treated as assertions by the group until corroborated by the victim or by independent investigation. In this case the facts record only that clop listed d2go.io and asserted the exfiltration of internal files; no further statements attributed specifically to this victim appear in the given record.

d2go.io and its sector

d2go.io is described as a technology company specialising in deep-learning-on-the-edge solutions. Its stated aim is to equip devices with cognitive capabilities at the network edge, reducing latency and bandwidth use while preserving privacy. The company targets industries that include automotive, healthcare and consumer electronics, applying machine-learning models together with software and hardware optimisation for tasks such as object detection, segmentation and tracking. Organisations of this kind typically hold source code, model weights, training data sets, customer and partner contracts, employee records, and technical documentation that may contain proprietary algorithms or configuration details. A breach involving internal files therefore carries potential consequences both for the company's intellectual property and for any personal or commercial data that those files may contain.

What was likely exposed

The only data type named in the public record is "internal files exfiltrated in a ransomware attack." Exact contents have not been disclosed. Organisations working on edge AI commonly store source repositories, trained models, design documents, employee directories, vendor agreements and project correspondence. Whether any of those categories were among the files taken in this incident is unconfirmed. Because the number of affected individuals is listed as unknown, it is not possible to state how many people, if any, appear in the material. Readers should treat the scope as limited to the group's claim of internal-file exfiltration until further official detail emerges.

Why it matters

For individuals, the practical risks centre on the possible misuse of any personal information that may have been present in the internal files—names, contact details, employment data or authentication credentials. Such information can be used for targeted phishing, identity fraud or social-engineering attempts against colleagues and partners. For the organisation, the exposure of proprietary models, code or commercial documents can affect competitive position and contractual obligations. Because the scale remains unknown and no confirmation of public release has been provided, the immediate impact is one of uncertainty: affected parties cannot yet assess the precise exposure, yet they must still consider prudent monitoring and protective measures. The listing itself also signals that the company is now part of a publicly visible extortion narrative, which can influence customer and partner confidence even before any data appears online.

Were you affected?

If you have been an employee, contractor, customer or partner of d2go.io, treat the listing as a reason to take basic precautions while waiting for any official notification. Practical first steps include:

• Monitor bank, credit and email accounts for unusual activity.
• Enable multi-factor authentication on important accounts and change passwords that may have been reused.
• Be alert to phishing messages that reference the company or technical projects.
• Request confirmation from the organisation if you believe you may hold sensitive data related to its work.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

Public detail remains limited; any further statements from the company or independent verification will clarify the true scope. Until then, measured vigilance is the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.