Encompass Group Listed by royal Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by stealing data and threatening public release, a pattern that has become a steady feature of the cyber-threat landscape rather than an exception. In that context, Encompass Group appeared on a listing associated with the royal ransomware group in April 2023.

Public reporting states that Encompass Group was listed by royal, with claims that internal files were exfiltrated. The number of people affected remains unknown, and independent confirmation of the full scope is limited. For employees, partners, and others who may have had dealings with the company, the listing raises practical questions about what may have been exposed and what steps are worth taking.

Inside the incident

According to available public detail, Encompass Group was listed by the royal ransomware group on or around 21 April 2023. The incident is described as a ransomware attack in which internal files were allegedly exfiltrated. Royal’s own leak-site material claimed that roughly 47 GB of data had been obtained from the company and that the material included employee passports, social security numbers, NDAs, contracts, and confidential agreements, with further documents said to be of interest. The group stated it would share the material later.

Beyond that listing and the group’s claims, public detail is limited. The precise method of initial access, the timeline of the intrusion, whether encryption was also deployed, and any negotiation or recovery steps have not been disclosed in the material provided. The number of individuals whose information may have been involved is unknown. The listing itself should be treated as an unverified claim by the threat actor unless and until independently confirmed.

The group behind it: royal

Royal is a ransomware operation that became widely documented in open reporting in 2022 and 2023. Like other groups in this category, it has typically combined data theft with encryption pressure, using leak sites to name victims and threaten publication if demands are not met. Public analyses have associated royal with double-extortion tactics: exfiltrating files before or alongside ransomware deployment, then advertising the haul to increase leverage.

The group has been linked in industry reporting to a range of sectors and to the use of common initial-access paths such as compromised credentials, exposed remote services, and phishing, though specific intrusion details vary by incident and are often not fully public. Royal’s leak-site posts function as claims by the actors; they are not independent verification. In this case, the facts record that Encompass Group was listed and that royal described a 47 GB set of internal files; those descriptions remain the group’s assertions rather than confirmed forensic findings published by the victim or regulators.

Who is Encompass Group?

Encompass Group was founded in 1999 and is headquartered in McDonough, Georgia. It manufactures and markets reusable textiles, professional apparel, and disposable and single-use medical products. Organisations in this space typically sit in supply chains that serve healthcare providers, hospitality, and related industries, and they commonly hold employee records, commercial contracts, supplier and customer agreements, and operational documents tied to regulated or sensitive environments.

A breach involving such a firm is consequential because the data held is not only internal business information but often includes personal identifiers of staff and confidential commercial terms. Even when the exact contents of a claimed dump are unconfirmed, the combination of workforce data and contractual material can create lasting risk for individuals and for the organisation’s relationships with partners and customers.

The information in question

Public facts name the exposed material as internal files exfiltrated in a ransomware attack. Royal claimed the haul included employee passports, social security numbers, numerous NDAs, contracts, and confidential agreements, and asserted that additional documents of interest were present. Those specifics come from the threat actor’s description and are not independently verified in the material available here. The number of people affected is unknown.

Organisations of this type typically maintain human-resources files, identity documents used for employment verification, tax and payroll identifiers, and a range of commercial agreements. Whether every category royal named was in fact taken, and in what volume, remains unconfirmed. Readers should treat the actor’s inventory as a claim, not as a completed audit of what left the network.

The real-world impact

If personal identifiers such as passport details or social security numbers were among the files, affected individuals face elevated risk of identity theft, fraudulent account opening, and targeted social engineering. Contracts, NDAs, and confidential agreements can expose commercial terms, pricing, or partnership structures that competitors or other adversaries might misuse, and they can create secondary pressure on counterparties named in those documents.

For Encompass Group, the consequences can include operational disruption, legal and regulatory scrutiny, notification obligations where personal data is involved, and erosion of trust with employees and business partners. Because the scale of affected people is undisclosed and the full contents unconfirmed, the precise breadth of harm cannot be stated from public facts alone; the realistic posture is caution and verification rather than assumption that exposure was either total or negligible.

If your data was in this claimed breach

If you are a current or former employee, contractor, or partner of Encompass Group, treat the royal listing as a reason to tighten basic defences even while details remain incomplete. Practical first steps include:

• Monitor bank, credit, and government-account activity for unfamiliar applications or changes, and consider a fraud alert or credit freeze where available in your jurisdiction.
• Be wary of unexpected calls, emails, or messages that reference employment, contracts, or identity documents; verify through known official channels before sharing information or clicking links.
• Change passwords on work-related and personal accounts that may have reused credentials, and enable multi-factor authentication where it is offered.
• If you hold copies of passports, Social Security cards, or similar documents that may have been stored by the company, note the date of any potential exposure and keep records of any suspicious follow-on contact.
• Run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets, and repeat periodically as new dumps are indexed.

Public detail on this incident remains limited to the April 2023 listing and the group’s claims about internal files. Stay alert to any official notice from Encompass Group or regulators, and base further action on confirmed notifications rather than on threat-actor statements alone.

AICompiled with AI assistance from public sources and published under our editorial standards.