dsrny.com Listed by ransomhub Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional service firms and creative studios as part of a broader pattern of double-extortion attacks, in which data is stolen before systems are encrypted and victims are pressured through public leak-site postings. Against that backdrop, the architecture and design practice known as dsrny.com appeared on a RansomHub listing in early 2025, drawing attention to the exposure of internal material from an organisation whose work shapes major public spaces.

Public reporting on 9 February 2025 stated that dsrny.com had been listed by the RansomHub ransomware group after an attack in which internal files were exfiltrated. The number of people affected remains unknown, and further operational details have not been released. The listing itself constitutes a claim by the group rather than independent confirmation of every asserted detail.

Inside the incident

According to the available record, dsrny.com was listed by RansomHub on or around 9 February 2025. The incident is described as a ransomware attack that included the exfiltration of internal files. No public figure has been given for the volume of data taken, the precise date of initial access, the entry vector, or the number of individuals whose information may have been involved. Those elements remain undisclosed. The organisation has not, in the material provided, issued a detailed technical account of containment or recovery steps.

What is stated is limited to the fact of the listing and the characterisation of the data as internal files obtained during the ransomware event. In the absence of further disclosure, the scale and full timeline cannot be established from open sources.

The group behind it: ransomhub

RansomHub is a ransomware operation that functions on a ransomware-as-a-service model. It emerged into wider notice after disruptions to other major groups and has been observed conducting double-extortion campaigns: encrypting systems while simultaneously stealing data and threatening to publish it on a dedicated leak site if payment is not made. The group typically recruits affiliates who carry out the intrusion and then share proceeds. Its public leak site serves both as a pressure mechanism and as a venue for claiming responsibility.

In this case the group claims that dsrny.com was a victim and that internal files were taken. That claim should be treated as an assertion by the actors rather than verified fact unless independently corroborated. RansomHub has listed numerous organisations across professional services, manufacturing and other sectors; the pattern is consistent with its established tactics, yet no additional statements specific to this victim beyond the listing itself appear in the given record.

dsrny.com and its sector

dsrny.com is the online presence of Diller Scofidio + Renfro, an interdisciplinary design studio based in New York City. The practice integrates architecture, visual arts and performing arts and is known for cultural and civic projects that include The High Line and The Shed. Its work frequently addresses the intersection of social space, technology, culture and environmental sustainability. Firms of this type routinely handle project documentation, client correspondence, design files, contracts, employee records and intellectual property related to large public and private commissions.

A breach affecting such a studio is consequential because the organisation sits at the centre of high-profile civic and cultural work. Compromised internal material can affect ongoing projects, client relationships and the confidentiality of design processes that involve multiple partners, public agencies and private clients. The sector as a whole has seen increased attention from ransomware operators precisely because the combination of valuable intellectual property and operational urgency can create leverage.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, categories or quantities has been disclosed. Organisations of this kind typically maintain design drawings, project specifications, contracts, financial records, employee and contractor information, client communications and proprietary research. Whether any of those categories were among the taken files remains unconfirmed. The exact contents of the exfiltrated material are therefore unknown on the basis of public reporting.

The real-world impact

For individuals whose personal or professional information may have been present in internal files, the principal risks include potential misuse of contact details, identity-related fraud if personal data was included, and exposure of sensitive project or employment information. Because the number of people affected is unknown and the precise data types are not listed beyond “internal files,” the concrete exposure for any given person cannot be quantified from available facts.

For the organisation itself, the incident raises the possibility of operational disruption, reputational questions among clients and partners, and the need to assess whether proprietary design material or contractual documents have left its control. Recovery from ransomware events commonly involves system restoration, forensic review and notification obligations where personal data is involved; none of those steps are detailed in the public record for this case.

If your data was in this claimed breach

If you have a past or present connection to Diller Scofidio + Renfro or dsrny.com—as an employee, contractor, client or collaborator—consider practical steps: monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and treat unsolicited communications that reference the firm with caution. Change passwords that may have been reused across work and personal services. Because the full scope of exposed data remains unconfirmed, these measures are precautionary rather than responses to a verified personal compromise.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a scan provides one additional data point but does not replace ongoing vigilance or official notifications that may be issued by the organisation if personal information is later confirmed to have been involved.

AICompiled with AI assistance from public sources and published under our editorial standards.