DAD.CO.TH Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 14, 2026, the Clop ransomware group listed DAD.CO.TH on its data-leak site and stated that internal files had been taken during a ransomware operation. The number of individuals affected remains unknown, and no further details on the volume or contents of the material have been made public. The incident reflects an ongoing pattern in which ransomware operators publish claims of stolen data to pressure victims. Public information about the event is limited to the listing itself and the description of the material as internal files.

Inside the incident

The listing appeared on February 14, 2026. The group claims to have exfiltrated internal files during a ransomware attack against the Thailand-based company. No information has been released on the date of the intrusion, the duration of access, or the quantity of data involved. The organization has not issued a public statement confirming or disputing the claim.

Who is clop?

Clop is a ransomware group that has conducted operations since at least 2019. Its typical approach combines encryption of systems with the theft of data, followed by demands for payment in exchange for both a decryption key and a promise not to publish the stolen material. The group has previously listed organizations from multiple sectors on its leak site when negotiations failed. Attribution of any specific incident rests on the group’s own statements unless independently verified.

DAD.CO.TH and its sector

DAD.CO.TH is described as a Thailand-based distributor of digital technology products, including smart-home devices, robotics, drones, e-scooters, audio-visual equipment, and virtual-reality hardware. Companies in this sector routinely maintain records related to suppliers, inventory, customer transactions, and product specifications. A compromise at such a firm can expose both commercial information and any personal data collected from clients or partners.

What data was at risk

The only detail provided is that internal files were allegedly exfiltrated. The precise categories of information contained in those files have not been disclosed. Organizations of this type commonly store customer contact details, order histories, payment records, and technical documentation, yet the exact contents in this case remain unconfirmed.

Why it matters

When internal files are removed, the primary concerns are the possible exposure of personal information and the potential for further misuse of commercial data. Individuals whose details appear in such material may face risks of targeted phishing or identity-related fraud. For the organization, the incident can lead to operational disruption and the need to review security controls around data storage and access.

Were you affected?

Begin by monitoring official communications from DAD.CO.TH for any guidance on the incident. Individuals can also check whether their email address appears in known breach datasets through a free exposure scan. Practical first steps include:

• Reviewing bank and credit-card statements for unusual activity.
• Enabling multi-factor authentication on accounts that may be linked to the company.
• Changing passwords for any services where the same credentials might have been reused.
• Remaining alert for unsolicited messages that reference the organization or recent transactions.

AICompiled with AI assistance from public sources and published under our editorial standards.