ESET. PREMIUM. Listed by donutleaks Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target software vendors and security firms as a way to amplify pressure, often by listing victims on leak sites even when full details remain sparse. In this climate of double-extortion tactics, a July 2024 listing involving ESET. PREMIUM. has drawn attention because it concerns a name closely tied to consumer and enterprise endpoint protection.

Public reporting indicates that the ransomware group donutleaks claimed to have listed ESET. PREMIUM. after a ransomware attack that involved the exfiltration of internal files. The number of people affected is unknown, and many operational details have not been disclosed. The claim matters because any compromise at a security-product organisation can raise questions about the data such firms hold and the potential knock-on effects for customers who rely on their tools.

Inside the incident

According to available records, ESET. PREMIUM. was listed by the donutleaks ransomware group on or around 20 July 2024. The group asserted that internal files had been exfiltrated during a ransomware attack. No confirmed figure for the number of individuals affected has been released, and the precise method of initial access, the volume of data taken, or any ransom demand remains undisclosed in public sources.

A reported summary associated with the listing stated, in the group’s own wording: “in preparation for the next goal, eset smart security premium was tested today. He fought epically, heroically and bravely with everything, with anything (mostly rubbish in C#), but, as befits a real AB, he chose not to notice the host of the party. It's something like drinking: once you fuck…” This text appears to frame the incident as a test of ESET Smart Security Premium software, yet it does not expand on technical indicators, timelines beyond the listing date, or verification of the claimed exfiltration. Independent confirmation of the breach itself has not been provided in the facts available.

Who is donutleaks?

donutleaks is a ransomware operation known for maintaining a public leak site on which it posts victim names and, in some cases, samples of stolen data. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also threatening to publish or sell exfiltrated material if payment is not made. Public reporting over recent years has documented the group’s practice of listing organisations across multiple sectors, often with short, taunting statements rather than detailed technical disclosures. The listing of ESET. PREMIUM. should be treated as an unverified claim by the group unless and until further corroboration emerges.

The group’s communications frequently mix technical boasts with informal or provocative language, as seen in the summary attached to this incident. Such posts serve both as pressure on the named organisation and as advertising to other potential victims or affiliates. No additional claims specific to this victim beyond the listing and the quoted summary appear in the provided facts.

ESET. PREMIUM. and its sector

ESET is a well-established cybersecurity company best known for its antivirus and endpoint-protection products, including consumer suites marketed under names such as ESET Smart Security Premium. Organisations of this type develop and distribute software that inspects files, network traffic and system behaviour for malicious activity; they therefore routinely handle product telemetry, customer licence data, support tickets and internal research material. A listing that names a premium product line is consequential because it sits at the intersection of software supply-chain trust and the protection of end users who depend on those tools.

Security vendors occupy a sensitive position in the threat landscape: any suggestion that their own systems have been compromised can erode confidence among customers and partners, even when the precise scope remains unclear. The sector as a whole has faced repeated targeting by ransomware operators seeking both financial gain and reputational leverage.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of those files—such as whether they contained customer records, source code, employee data or other categories—has been disclosed. Organisations that produce security software typically retain a range of sensitive material, including development repositories, configuration data, customer support histories and internal communications. Because the exact contents remain unconfirmed, it is not possible to state with certainty what specific data types, if any, left the organisation’s control.

Public detail is therefore limited to the group’s assertion of “internal files.” Readers should treat any more granular descriptions circulating online as unverified unless they originate from the organisation itself or from independent forensic reporting.

Why it matters

For individuals who use ESET products, the primary concern is whether any personal or account-related information was among the material claimed to have been taken. Even when customer data is not explicitly named, internal files can sometimes include support logs, licence keys or contact details that enable secondary fraud or phishing. For the organisation, a public listing by a ransomware group creates operational and reputational pressure, potentially requiring incident-response resources, customer notifications and reviews of security controls.

Because the number of people affected is unknown and the precise data types are unconfirmed, the real-world impact cannot yet be quantified. The incident nonetheless illustrates the broader risk that ransomware operators pose to the cybersecurity industry itself: a successful claim against a security vendor can be used to undermine trust in protective tools more widely.

What to do if you're exposed

If you hold an ESET product licence or have interacted with the company, practical first steps remain the same as for any potential exposure:

• Monitor official statements from ESET for any confirmation or guidance specific to this listing.
• Change passwords on related accounts and enable multi-factor authentication where available.
• Watch for unexpected emails or calls that reference ESET products or support; treat unsolicited requests for credentials or payment as suspicious.
• Review bank and credit statements for unusual activity if you have shared payment details with the company.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in other incidents.

Public detail on this particular claim remains limited. Continued caution and reliance on verified sources are the most reliable responses until further facts emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.