DataBank Listed by hunters Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target infrastructure and technology providers as a way to pressure organizations and amplify the impact of stolen data. In that landscape, DataBank was listed by the hunters ransomware group in a claim reported on April 03, 2024. Public detail is limited: the listing asserts that internal files were exfiltrated in a ransomware attack, with data taken but systems not encrypted, and the organization is identified as based in the United States. The number of people affected remains unknown. The incident matters because a data-center and colocation provider sits at the center of many other organizations’ operations; any confirmed compromise of internal material can create secondary risk for customers and partners even when encryption did not occur.

Breaking down the breach

According to the available record, DataBank was listed by the hunters ransomware group with a reported date of April 03, 2024. The summary associated with the listing states that data was exfiltrated and that data was not encrypted. The only data type named is internal files said to have been taken in a ransomware attack. No figure is given for the volume of material, no technical method of initial access or lateral movement is disclosed, and the number of people affected is listed as unknown. The listing itself is a claim by the group; independent confirmation of the full scope is not provided in the public facts. Country of the organization is recorded as the United States of America. Beyond those points, timing of the intrusion, duration of access, and any negotiation or recovery steps remain undisclosed.

Who is hunters?

Hunters is a ransomware operation that has appeared in public reporting as a group that conducts extortion-focused campaigns and publishes victim listings on leak-style sites. Like many contemporary ransomware actors, such groups typically claim to have stolen data and threaten to release it if demands are not met; some also deploy encryption, though the facts for this incident state that encryption did not occur. Publicly documented activity associated with hunters-style operations has included targeting of commercial and infrastructure-related organizations and the use of double-extortion narratives—data theft paired with the threat of publication. Specific claims the group has made about DataBank beyond the listing itself are not detailed in the available facts; the listing should be treated as an unverified assertion until corroborated by the victim or independent investigation.

Who is DataBank?

DataBank is a United States-based provider of data-center, colocation, and related infrastructure services. Organizations of this type operate facilities that house servers, networking equipment, and connectivity for enterprise, cloud, and other customers. They routinely manage operational documentation, customer contracts and configurations, employee and vendor records, network diagrams, and access-related materials. A breach affecting such a provider is consequential because the same internal files that support day-to-day facility and customer operations can, if exposed, reveal sensitive commercial relationships, technical layouts, or personal information tied to staff and clients. Even without system encryption, the claimed exfiltration of internal files raises questions about potential secondary exposure for the organizations that rely on DataBank’s infrastructure.

What was likely exposed

The facts name “internal files” as the material said to have been exfiltrated. Exact contents, file counts, and whether personal data of customers or employees were included are not disclosed and remain unconfirmed. Organizations in the data-center and colocation sector typically hold a range of sensitive material; without confirmation, it is only possible to note what is commonly present rather than what was taken in this case:

• Operational and facility documentation, including network and systems information
• Customer and contract records, service configurations, and related commercial data
• Employee, vendor, and access-management materials
• Any logs or supporting files generated in the course of running multi-tenant infrastructure

Readers should treat any more specific description of the stolen set as speculative until the organization or a verified investigation provides it.

What's at stake

For individuals whose information may appear in internal files—employees, contractors, or contacts at customer organizations—the practical risks include phishing and social-engineering attempts that leverage accurate internal details, potential identity-related misuse if personal identifiers were present, and longer-term exposure if the material is later published or resold. For DataBank and its customers, the stakes include reputational harm, possible regulatory or contractual scrutiny, and the operational cost of investigating and containing any confirmed compromise. Because the facts state that encryption did not occur, immediate service disruption from locked systems is not indicated by the public record; the primary reported concern is the claimed theft and potential release of internal files. The unknown number of affected people means the full human impact cannot yet be quantified.

What to do if you're exposed

If you have a relationship with DataBank as an employee, customer, or partner, treat the listing as a signal to increase caution rather than as confirmed proof that your own data was taken. Practical first steps include monitoring financial and account activity for unusual behavior, enabling multi-factor authentication on important accounts, and being alert to targeted phishing that references internal or company-specific details. Change passwords on any accounts that may have been reused or shared in work contexts, and review recent access logs where you control them. Organizations should follow their own incident-response and notification procedures and seek independent forensic confirmation rather than relying solely on a ransomware group’s claim. Individuals can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check does not prove or disprove involvement in this specific incident but can surface other exposures that warrant attention. Public detail on this event remains limited; updates from the organization or verified investigators should be preferred over unverified leak-site statements.

AICompiled with AI assistance from public sources and published under our editorial standards.