Exco Listed by sinobi Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 5, 2026, the ransomware group sinobi listed Exco on its leak site. The number of people whose data may be involved is not known, and no further details about the scale or timing of the incident have been made public. Exco is a network of accounting, consulting and audit firms operating in France and internationally. The listing indicates that internal files were taken during a ransomware attack, though confirmation of the exfiltration or any subsequent publication of material rests solely on the group’s claim.

Inside the incident

The only confirmed public information is the February 5, 2026 listing by sinobi. No figure for the volume of data, the date of the intrusion, or the method used has been disclosed. The entry describes the removal of internal files, but does not specify whether the material has been released or remains under the group’s control.

The group behind it: sinobi

Sinobi is a ransomware operator that maintains a leak site to list victims and, in some cases, to publish stolen material. The group’s listing of Exco constitutes a claim by the actor; independent verification of the incident or of the data’s status has not been reported. Public records of the group’s activity show a pattern of targeting organisations that hold sensitive operational records, though each incident must be assessed on its own facts.

Exco and its sector

Exco provides accounting, audit, tax, payroll and legal services to businesses. Firms in this sector routinely process financial statements, employee records, tax filings and corporate governance documents. A breach at such an organisation can expose information that extends beyond the firm itself to its clients, whose financial and operational details are held in the course of normal service delivery.

What data was at risk

The listing refers to internal files exfiltrated in a ransomware attack. No inventory of specific file types or data fields has been released. Organisations of this kind commonly hold client financial data, employee identifiers and contractual records, but the precise contents of the material claimed in this case remain unconfirmed.

The real-world impact

Exposure of internal files from an accounting and advisory firm can create downstream risks for the businesses that rely on those services, including the potential for targeted fraud or the use of confidential financial information. For Exco, the incident adds operational and reputational costs associated with investigation, client notification and any required regulatory reporting. The absence of a confirmed count of affected individuals limits a full assessment of personal impact at this stage.

Were you affected?

Individuals or client organisations concerned about possible exposure should contact Exco directly for information on the scope of the incident. Practical steps include monitoring bank and tax accounts for unusual activity, reviewing credit reports where available, and changing passwords for any services linked to the firm. Readers may also run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.