Epiq Global (MSP) Listed by ryuk Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In February 2020, Epiq Global, identified as a managed service provider, was listed on a leak site operated by the ryuk ransomware group. The group claims to have exfiltrated internal files during a ransomware attack, though the number of individuals affected and the precise contents of any data remain undisclosed in public reporting. The appearance of the organization on the site drew attention because managed service providers often maintain access to systems and records belonging to other entities. At the time, such listings were becoming a recurring element in ransomware operations that combined encryption with data theft.

Inside the incident

Public records show only that Epiq Global was added to the ryuk leak site on 29 February 2020. The group claims to have stolen internal data, described in available summaries as files taken during a ransomware attack. No confirmed count of affected individuals, volume of data, or specific file categories has been released by the organization or independent investigators.

Details on the initial access method, duration of the intrusion, or whether any data was subsequently published or sold are not available in the reported facts. The organization has not issued a public statement confirming or disputing the claims in the material examined here.

Inside ryuk

Ryuk is a ransomware operation that has been publicly tracked since 2018. The group is known for selecting larger organizations, deploying ransomware that encrypts files, and in some cases exfiltrating data before encryption. It has maintained a practice of listing claimed victims on a dedicated site, presenting this as evidence of stolen material.

Public reporting on ryuk has documented its use of common initial access techniques such as phishing and exploitation of remote desktop services, followed by lateral movement inside target networks. The group’s listings are treated as claims rather than independently verified incidents unless corroborated by the affected organization or law enforcement.

Epiq Global (MSP) and its sector

Epiq Global operates as a managed service provider, supplying information technology support and infrastructure services to client organizations. MSPs in this sector routinely hold administrative credentials, system configurations, and records that pertain to the networks they manage for others.

Because an MSP’s environment can contain data belonging to multiple downstream clients, an incident at such a firm carries the potential to affect a wider set of organizations than a breach limited to a single end-user company. Public information does not specify the exact client base or data holdings of Epiq Global in this case.

The information in question

The only detail provided is that internal files were claimed to have been exfiltrated. No inventory of data types, such as personal identifiers, financial records, or communications, has been disclosed. Organizations of this type commonly store configuration data, authentication material, and client-related operational records, yet the exact contents remain unconfirmed.

Why it matters

Exposure of internal files from a managed service provider can create downstream risks for any clients whose systems or records were accessible through that provider. These risks include potential misuse of credentials or configuration details that could facilitate further unauthorized access.

For individuals whose information may reside in those files, the practical consequences depend on the nature of the data and whether it is later distributed. Without Reported Details on the data types or volume, the scale of personal impact cannot be quantified from available information.

What to do if you're exposed

Individuals concerned about possible exposure should monitor accounts for unusual activity and consider enabling multi-factor authentication where available. They can also request copies of any data held by organizations with which they have a relationship and review privacy settings on those accounts.

Readers may run a free exposure scan of their email address against known breach data to determine whether their information appears in publicly reported incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.