Derrimon Trading was hacked. Critical data of the company and its customers was stolen Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized commercial firms across regions, pairing data theft with public leak-site pressure in an effort to force payment. In that broader pattern, Derrimon Trading appeared in September 2023 on a listing associated with the alphv ransomware group, which claimed the company had been hacked and that critical data belonging to the firm and its customers had been stolen.

Public detail on the incident remains limited. What is known comes chiefly from the group's claim and basic organisational information; the number of people affected has not been established, and independent confirmation of the full scope has not been widely reported. For customers, suppliers and staff connected to a Jamaican trading business, even an unverified claim of this kind warrants careful attention.

Inside the incident

According to available reporting, Derrimon Trading was listed by the alphv ransomware group on or around 12 September 2023. The headline associated with the listing stated that the company had been hacked and that critical data of the company and its customers had been stolen. The same reporting characterises the event as a ransomware attack in which internal files were allegedly exfiltrated.

No public figure has been given for the volume of data taken, the precise date of initial access, or the technical method used. The number of people affected is recorded as unknown. Beyond the group's claim that internal files were removed and that customer-related material was among what was stolen, further operational detail has not been disclosed in the material provided. The listing itself should be treated as an assertion by the threat actor rather than as independently verified fact.

Who is alphv?

Alphv, also widely known in security reporting as BlackCat, is a ransomware operation that has functioned on a ransomware-as-a-service model. Affiliates gain access to victim networks, deploy the group's encryptor, and commonly exfiltrate data before encryption so that the operators can threaten public release if a ransom is not paid. The group has been linked to numerous attacks on organisations in multiple sectors and countries, and it has maintained a dark-web leak site on which it names victims and, in some cases, publishes samples or larger archives of stolen material.

Typical tactics associated with alphv include double extortion—combining encryption with data theft—and the use of customisable ransomware written in modern languages that can target varied environments. Public reporting has documented the group's activity over several years prior to 2023. None of that general history, however, constitutes proof of every specific claim the group makes about an individual victim; each listing remains a claim until corroborated by the organisation or by independent investigation.

Who is Derrimon Trading?

Derrimon Trading is a commercial enterprise headquartered at 235 Marcus Garvey Drive, Kingston, Jamaica. Public contact details associated with the firm include the telephone number (876) 901-3344 and the website www.derrimon.com, along with a Facebook presence. Organisations of this type typically operate in wholesale, distribution or related trading activities, handling supplier relationships, inventory, invoicing and customer accounts.

A breach affecting such a firm is consequential because trading companies routinely hold commercial contracts, payment and shipping records, employee information and customer contact or account data. Disruption or exposure can affect not only the company itself but also the businesses and individuals who buy from or supply it. The Jamaican base of operations also means that any confirmed incident would sit within the Caribbean commercial and regulatory environment, where notification practices and consumer protections may differ from those in larger markets.

The information in question

The facts available name the exposed material as internal files exfiltrated in a ransomware attack. The group's listing further claimed that critical data of the company and its customers was stolen. No itemised inventory of file types, databases or record counts has been published in the material at hand, and the exact contents remain unconfirmed.

Organisations engaged in trading and distribution commonly store customer names and contact details, order and invoice histories, supplier agreements, internal financial and operational documents, and employee records. Whether any or all of those categories were present in the material alphv claims to hold has not been independently established. Readers should therefore treat descriptions of “critical” or “customer” data as the actor’s characterisation rather than as a verified catalogue.

What's at stake

For individuals whose information may have been involved, the practical risks include unwanted contact, phishing that references real transactions or account details, and potential misuse of personal or financial identifiers if such data were present. For business customers and suppliers, exposed contracts or pricing information could be used in social-engineering attempts or competitive intelligence. None of these outcomes is guaranteed; they depend on what was actually taken and how it is later used.

For Derrimon Trading, the stakes include operational disruption if systems were encrypted, reputational harm from the public claim, possible regulatory or contractual notification duties, and the cost of investigation and remediation. Because the scale of the incident and the precise data types remain undisclosed, the full extent of exposure for any single person or partner cannot yet be stated with certainty.

If your data was in this claimed breach

If you have done business with Derrimon Trading or believe your details may have been held by the company, treat the situation as a precautionary matter. Monitor account statements and credit activity for unfamiliar transactions. Be sceptical of unexpected emails, calls or messages that reference the company or recent orders; verify any request for payment or personal information through a known official channel. Consider changing passwords on related accounts and enabling multi-factor authentication where available. If you receive notification directly from the company, follow the specific guidance it provides.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or rule out involvement in this particular incident, but it can indicate whether your credentials or contact details appear in other publicly tracked leaks and help you prioritise further protections.

AICompiled with AI assistance from public sources and published under our editorial standards.