Dorner (dorner-gmbh.de) Listed by fog Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to list organisations on leak sites as a core pressure tactic in double-extortion campaigns, claiming to have stolen data even when independent confirmation is limited. In this environment, a December 2024 listing of a German industrial firm by the fog group fits a familiar pattern of opportunistic targeting of mid-sized companies whose systems hold operational and internal records.

Public reporting indicates that Dorner (dorner-gmbh.de) was listed by the fog ransomware group on 5 December 2024. The group claims to have exfiltrated roughly 1 GB of internal files during a ransomware attack. The number of people affected remains unknown, and independent verification of the full scope has not been published. The listing itself is a claim by the threat actor rather than a confirmed disclosure by the organisation.

Inside the incident

According to available public records, the incident centres on a ransomware attack in which fog claims to have stolen internal files from Dorner. The reported volume is 1 GB. No further technical details—such as the initial access method, the exact date of intrusion, encryption of systems, or any ransom demand—have been disclosed in the source material. The number of individuals whose data may have been involved is listed as unknown. The only concrete elements on record are the organisation’s name and domain, the reporting date of 5 December 2024, the claimed data volume, and the characterisation of the material as internal files obtained through a ransomware attack. Everything else about timing, scale, or method remains undisclosed.

Who is fog?

Fog is a ransomware operation that became active in public reporting during 2024. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems while also exfiltrating data and threatening to publish it on a dedicated leak site if payment is not made. Public analyses of fog activity describe opportunistic targeting across manufacturing, professional services and other mid-market sectors, often using commodity access methods and living-off-the-land techniques once inside a network. The group’s leak-site listings function as both pressure and advertising; they are claims by the actor and are not automatically verified. In this case, fog’s listing of Dorner should be treated as an unverified assertion that internal files were taken, rather than as independently confirmed fact.

Who is Dorner (dorner-gmbh.de)?

Dorner is a German company operating under the domain dorner-gmbh.de. Publicly available information places it in the industrial automation and conveyor-systems sector, supplying equipment and related engineering services used in manufacturing and material-handling environments. Organisations of this type routinely maintain internal files that can include engineering drawings, customer project data, supplier contracts, employee records, financial documents and operational correspondence. A breach involving such material is consequential because it can expose both commercial intellectual property and personal information of staff or business partners, creating risks that extend beyond the company itself into its supply chain and workforce.

What data was at risk

The only data type named in the available facts is “internal files” said to have been exfiltrated in a ransomware attack, with a reported volume of 1 GB. No more granular inventory—such as whether the files contained personal data, credentials, financial records or technical designs—has been disclosed. For a company in the industrial-equipment sector, internal files would typically encompass a mix of business and operational material. Because the exact contents remain unconfirmed, it is not possible to state with certainty what categories of information were actually taken. The claim of 1 GB of internal files is the sole quantitative detail on record.

The real-world impact

If the claimed exfiltration occurred, affected individuals could face risks of identity misuse, targeted phishing or social-engineering attempts that leverage any personal details present in the files. Employees, contractors or business contacts whose information appeared in internal documents would be the most directly exposed. For the organisation, the consequences can include operational disruption, potential regulatory notification obligations under European data-protection rules, reputational harm with customers and partners, and the cost of investigation and remediation. Because the number of people affected is unknown and the precise contents unconfirmed, the scale of these risks cannot yet be quantified. The listing itself may already generate secondary effects such as increased scrutiny from clients and heightened phishing activity that references the incident.

If your data was in this claimed breach

Anyone who has had a professional or personal relationship with Dorner should treat the possibility of exposure seriously even while details remain limited. Practical first steps include monitoring financial and email accounts for unusual activity, enabling multi-factor authentication wherever available, and being alert to phishing messages that mention the company or the ransomware group. Changing passwords that may have been reused across work and personal services is advisable. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. If you believe you are directly affected, consider contacting Dorner through official channels for any guidance the company may issue, and retain records of any suspicious communications that reference the incident.

AICompiled with AI assistance from public sources and published under our editorial standards.