DELARUE.COM Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 6 July 2023, DELARUE.COM, the online presence of De La Rue, a company specialising in currency and authentication solutions, was listed by the clop ransomware group. Public reporting indicates that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further specifics about the incident have not been disclosed.

The listing itself constitutes a claim by the group rather than independent confirmation of every detail. For an organisation that handles sensitive production and security-related material, any confirmed exposure of internal files carries clear implications for both the company and those whose information may have been held in its systems.

What happened

According to available public information, DELARUE.COM was listed by the clop ransomware group on or around 6 July 2023. The reported summary identifies the organisation as De La Rue, focused on currency and authentication solutions, and states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of individuals affected. Details such as the precise method of initial access, the exact volume of data taken, the duration of any network presence, or whether a ransom demand was paid have not been disclosed in the material available. The incident is therefore known primarily through the group’s leak-site listing and the accompanying description of internal-file exfiltration.

Who is clop?

Clop is a well-documented ransomware operation that has been active for several years. The group is known for double-extortion tactics: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. Clop has previously targeted large organisations across multiple sectors, often exploiting vulnerabilities in widely used file-transfer or remote-access software to gain initial entry at scale. Once inside a network, the group typically moves laterally, identifies valuable data, exfiltrates it, and then deploys ransomware. Listings on its leak site serve both as pressure on the victim and as public claims of successful intrusion. In this case, the appearance of DELARUE.COM on that site is treated as a claim by the group; independent verification of the full scope has not been supplied in the reported facts.

DELARUE.COM and its sector

De La Rue is a long-established company whose core business centres on the design, production and authentication of banknotes and related secure documents, together with broader authentication and security solutions. Organisations of this type routinely handle highly sensitive technical specifications, production data, supply-chain information, commercial contracts and, in many cases, personal data belonging to employees, contractors and business partners. Because the work involves national currencies and anti-counterfeiting technologies, the confidentiality of internal files is integral to both commercial competitiveness and public trust. A breach affecting such an entity is therefore consequential beyond ordinary corporate data loss: it can touch on the integrity of secure manufacturing processes and the personal information of people connected to those operations.

What was likely exposed

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, record counts or specific data categories has been publicly disclosed. Organisations operating in currency printing and authentication typically maintain technical drawings, process documentation, quality and compliance records, supplier and customer correspondence, financial and contractual material, and employee or contractor personal data. It is reasonable to expect that some combination of these categories could have been among the internal files taken, yet the exact contents remain unconfirmed. Readers should treat any assumption about particular documents or personal records as speculative until official clarification is provided.

Why it matters

For individuals whose information may have been held by De La Rue, exposure of internal files can create lasting practical risks. Personal details, if present, may be used for targeted phishing, identity fraud or social-engineering attempts that reference genuine employment or commercial relationships. Even purely technical or commercial material can be leveraged to craft more convincing scams against staff or partners. For the organisation itself, the incident raises concerns about operational continuity, the possible compromise of proprietary security know-how, regulatory notification obligations, and reputational damage with governments and commercial clients who rely on the integrity of its products. Because the scale of affected individuals is unknown, the full human impact cannot yet be quantified, but the combination of ransomware and data theft means both immediate disruption and longer-term residual risk are present.

If your data was in this claimed breach

If you believe you have a past or present connection to De La Rue—as an employee, contractor, supplier or customer—treat the possibility of exposure seriously. Monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever available, and be alert to unsolicited messages that reference the company or its work. Consider placing fraud alerts with relevant credit-reference services if you are concerned about identity misuse. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Official updates from the organisation, if issued, should be followed for any specific guidance or support offered to those affected.

AICompiled with AI assistance from public sources and published under our editorial standards.