DOVERN Import Listed by spacebears Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 21 October 2025, the ransomware group spacebears listed DOVERN Import on its leak site, claiming the company had suffered a ransomware attack in which internal files were exfiltrated. Public detail remains limited: the number of people affected is unknown, and no further technical specifics about timing, scale or method have been released. The listing itself is an unverified claim by the group.

For a specialist wine and champagne importer serving clients and restaurateurs in Morocco, any confirmed exposure of internal material could affect business relationships, operational continuity and the privacy of individuals whose details appear in company records. What is known so far is confined to the group’s public claim and the organisation’s own description of its work.

What happened

According to the available record, DOVERN Import was listed by the spacebears ransomware group on 21 October 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No independent confirmation of the intrusion, the volume of data taken, or the precise date of the incident has been published. The number of individuals potentially affected is recorded as unknown. No ransom demand figure, encryption details or other technical indicators have been disclosed in the public summary. The sole concrete assertion is the group’s claim of file exfiltration and the subsequent listing of the company.

Who is spacebears?

spacebears is a ransomware operation that follows the now-familiar double-extortion model used by many contemporary groups. After gaining access to a network, operators typically encrypt systems and simultaneously copy data, then threaten to publish the stolen material on a dedicated leak site if payment is not made. Listings on such sites serve both as pressure on the victim and as advertising of the group’s activity. Public reporting over recent years has associated spacebears with attacks on organisations across multiple sectors and geographies; the group’s communications are generally limited to the claims posted on its leak site. In the present case, the only statement attributed to spacebears is the listing of DOVERN Import and the assertion that internal files were taken. No additional claims specific to this victim have been recorded in the available facts.

Who is DOVERN Import?

DOVERN Import is a Moroccan company that has specialised, since 2001, in the selection and importation of rare wines and champagnes, primarily from French regions including the Rhône Valley, Champagne, Burgundy and Bordeaux. Its stated mission is to introduce unique and often lesser-known wineries to enthusiasts and restaurateurs in Morocco while maintaining strict quality standards. As an importer and distributor of premium alcoholic beverages, the firm necessarily maintains commercial relationships with overseas producers, local clients, logistics partners and regulatory bodies. Organisations of this type typically hold supplier contracts, customer and restaurateur contact lists, shipping and customs documentation, financial records and internal operational files. A breach involving such material can therefore touch both the commercial core of the business and the personal or professional data of individuals who deal with it.

What was likely exposed

The facts state only that “internal files” were exfiltrated in a ransomware attack. No inventory of those files, no categories of personal data, and no confirmation of customer, employee or financial records have been published. Exact contents therefore remain unconfirmed. In the ordinary course of business an importer of fine wines and champagnes would be expected to hold supplier agreements, purchase orders, client and restaurateur contact details, delivery and customs paperwork, invoices, and internal correspondence. Whether any of those categories were among the files claimed by spacebears is not known. Readers should treat any assertion of specific data types beyond the phrase “internal files” as speculative until further official disclosure occurs.

The real-world impact

If the group’s claim is accurate, the principal risks fall into two categories. For individuals whose names, contact details or transaction histories appear in the exfiltrated material, the usual consequences of data exposure apply: possible phishing or social-engineering attempts that reference genuine business relationships, and the longer-term possibility that the information is reused or resold. For DOVERN Import itself, the operational impact of a ransomware incident can include temporary disruption of ordering and logistics systems, reputational damage among suppliers and clients, and the cost of investigation and recovery. Because the company operates in a relationship-driven niche market, loss of confidence among French producers or Moroccan restaurateurs could have lasting commercial effects. None of these outcomes can be quantified from the limited public record; they remain potential rather than demonstrated harms.

Were you affected?

If you have done business with DOVERN Import—whether as a client, restaurateur, supplier or employee—monitor communications carefully for unexpected messages that appear to reference genuine past transactions. Consider changing passwords on any accounts that may have been used in correspondence with the company, and enable multi-factor authentication where available. Because the precise contents of the claimed data set are unknown, there is no definitive public list of affected individuals. A practical next step is to run a free exposure scan of your email address against known breach data sets; such a check can indicate whether your address has already appeared in previously published collections, though it cannot confirm or rule out involvement in this specific incident. Remain alert for further statements from the company or from independent researchers as more verified information becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.