Evo exhibits Listed by donutleaks Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continued through 2022 to pressure organisations by pairing encryption with data theft and public leak-site listings, turning internal files into leverage even when the full scope of an intrusion remained unclear. In that environment, the appearance of a company name on a criminal forum often becomes the first public signal that something has gone wrong.

On 28 September 2022, Evo exhibits was listed on the donutleaks ransomware leak site. The group claims to have stolen internal data in a ransomware attack. The number of people affected is unknown, and public detail beyond the listing itself is limited. For anyone whose information may have been held by the organisation, the episode underscores how quickly business files can move from private systems into criminal hands.

Inside the incident

Public reporting states that Evo exhibits appeared on the donutleaks leak site on 28 September 2022. According to the listing, the group claims to have exfiltrated internal files during a ransomware attack. No further verified particulars—such as the precise date of initial access, the ransomware variant used, the volume of data taken, or confirmation that encryption occurred—have been disclosed in the available record. The number of individuals whose information may have been involved remains unknown. What is established is only the claim of theft of internal files and the public listing itself.

Because the incident rests on a leak-site entry rather than a detailed victim or law-enforcement confirmation, the full sequence of events stays opaque. Organisations facing such claims typically investigate quietly while assessing whether the posted material is authentic; that process, and any subsequent notifications, are not part of the public facts provided here.

Inside donutleaks

Donutleaks is a ransomware operation that has followed the now-common double-extortion model: encrypting systems where possible while also copying data and threatening to publish it on a dedicated leak site if payment is not made. Groups of this type typically advertise victims with brief descriptions and sample files, then release larger archives in stages to increase pressure. Their public postings are claims, not independently verified inventories, and the material they display can range from genuine stolen documents to incomplete or staged samples.

Like other actors in this category, donutleaks has historically targeted a mix of mid-sized and larger organisations across multiple sectors rather than focusing on a single industry. The group’s leak site serves both as a negotiation tool and as a reputation mechanism within the criminal ecosystem. Nothing in the public record of this specific listing goes beyond the assertion that internal data belonging to Evo exhibits was taken; any broader characterisation of the group’s motives or technical methods in this case would be speculation.

Evo exhibits and its sector

Evo exhibits operates in the exhibitions and trade-show sector, an industry that designs, builds and manages temporary displays, stands and experiential environments for corporate clients, trade fairs and public events. Companies in this field routinely handle project specifications, client contracts, supplier agreements, floor plans, staffing rosters and financial records tied to individual shows. They may also store employee personal data, visitor or lead information collected at events, and proprietary design files.

A breach affecting such an organisation is consequential because the data often spans multiple third parties—clients, contractors, freelancers and sometimes end customers—creating a wider circle of potential exposure than a purely internal corporate incident. Even when the precise contents of a theft remain unconfirmed, the mere possibility that commercial and personal records have left the organisation’s control can disrupt ongoing projects, damage commercial relationships and trigger regulatory notification duties in jurisdictions that treat personal data as protected.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack and that the group claims to have stolen internal data. No itemised inventory of those files has been published in the record provided. Exact contents therefore remain unconfirmed.

Organisations of this type typically hold a mixture of business-critical and personal information: contracts and invoices, design and production files, employee records, client contact lists, and sometimes attendee or lead data gathered at exhibitions. Any of those categories could theoretically have been among the internal files referenced by the listing, yet it is not possible to state that specific data types were exposed. Readers should treat the claim of theft as an unverified assertion until further official detail emerges.

The real-world impact

For individuals whose details may have been stored by Evo exhibits, the practical risks include targeted phishing that references real projects or colleagues, identity-related fraud if personal identifiers were present, and longer-term uncertainty about where copies of the data now reside. Because the scale of the incident is unknown, it is impossible to quantify how many people face these risks.

For the organisation itself, the consequences centre on operational disruption, potential contractual liabilities to clients whose information may have been involved, and the reputational cost of a public ransomware listing. Recovery from ransomware often involves system restoration, forensic review and notification processes that consume time and resources even when the full extent of data loss stays unclear. None of these outcomes imply established negligence; they are simply the ordinary downstream effects of a claimed data-theft incident in this sector.

If your data was in this claimed breach

If you have done business with Evo exhibits, worked for the company, or otherwise supplied personal or commercial information to it, treat the listing as a prompt to heighten caution rather than as confirmed proof that your records were taken. Monitor financial and email accounts for unusual activity, be sceptical of unexpected messages that reference exhibitions or past projects, and consider placing fraud alerts with relevant credit services if you believe sensitive identifiers may have been involved. Change passwords on any accounts that reused credentials associated with the organisation, and enable multi-factor authentication where it is available.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step will not confirm or rule out involvement in this specific incident, but it can indicate whether your details appear in other publicly circulating collections and help you prioritise further protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.