Exset Listed by malas Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 09, 2023, the organisation Exset was listed by the ransomware group malas, which claimed responsibility for a ransomware attack that involved the exfiltration of internal files. Public reporting links the intrusion to exploitation of a Zimbra vulnerability. The number of people affected remains unknown, and wider confirmation of the incident’s full scope has not been detailed in available records.

For anyone connected to Exset—employees, partners, or others whose information may have been held in internal systems—the listing raises practical questions about what was taken and what steps to take next. Detail remains limited, so the known facts are set out below without speculation.

What happened

According to the available record, Exset appeared on a listing associated with the malas ransomware group on or around April 09, 2023. The group is reported to have conducted a ransomware attack in which internal files were allegedly exfiltrated. The reported summary attributes the initial access to exploitation of a Zimbra vulnerability. Zimbra is a widely used collaboration and email platform; vulnerabilities in such software have been leveraged by various threat actors in other incidents, though the precise technical path in this case is not further described in the public facts.

No confirmed figure for the number of individuals affected has been released. The scale of the file exfiltration, the exact timing of the intrusion relative to the listing date, and whether encryption or other ransomware effects were also deployed are not detailed beyond the core claim of internal files being taken. As with many leak-site listings, the group’s assertion stands as a claim pending independent verification or official statements from the organisation.

The group behind it: malas

Malas is a ransomware group known in public reporting for double-extortion style operations: encrypting systems or threatening to do so while also exfiltrating data and listing victims on dedicated leak sites to pressure payment. Like other actors in this category, the group typically publicises victim names and sometimes samples of stolen data to demonstrate access. Specific claims made by malas about any single victim, including Exset, should be treated as assertions by the group rather than independently What's Publicly Reported unless corroborated elsewhere.

Public knowledge of malas centres on its pattern of targeting organisations, exploiting available vulnerabilities or weak remote access, and using leak-site pressure. No additional claims by the group about the Exset incident—beyond the listing itself and the reported use of a Zimbra vulnerability and exfiltration of internal files—are included in the facts at hand. Prior activity by such groups is documented across multiple sectors, but those histories do not automatically transfer details to this case.

About Exset

Exset is the organisation named in the listing. Publicly available background specific to its size, exact industry niche, or internal structure is limited in the materials provided for this account; organisations of comparable profile commonly operate in commercial, professional, or service sectors and maintain internal file stores, email and collaboration systems, and records relating to staff, clients, or operations.

A breach involving internal files at any such organisation is consequential because those repositories often contain operational documents, correspondence, and data tied to people who interact with the entity. Even without a full public profile of Exset, the presence of a ransomware group’s claim and the reported exfiltration of internal material means the incident carries weight for confidentiality, trust, and potential follow-on misuse of any exposed information.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, volumes, or named categories of personal or corporate data has been disclosed. People affected are recorded as unknown.

Organisations that run email and collaboration platforms such as Zimbra, and that hold internal file stores, typically retain business documents, internal communications, employee-related records, and material linked to customers or partners. That is the general pattern for entities of this kind; it is not a confirmation of what was allegedly taken from Exset. Exact contents remain unconfirmed. Readers should not assume specific data elements were or were not included beyond the stated “internal files.”

What's at stake

For individuals whose information may have been among the internal files, real-world risks include unwanted contact, phishing that references genuine internal details, or attempts to misuse personal or professional data if it was present. Without a confirmed inventory, the precise exposure for any one person cannot be stated. For the organisation, stakes include operational disruption, potential regulatory or contractual obligations depending on jurisdiction and data types, and the longer-term need to restore confidence among staff and external parties.

Ransomware incidents that combine exfiltration with a public listing also create secondary pressure: the threat of further publication or sale of material. Whether that material has been released more widely is not established in the given facts. The absence of a known affected-person count does not eliminate risk; it simply means the perimeter of impact is still unclear.

Were you affected?

If you have a relationship with Exset—as an employee, contractor, client, or partner—consider practical steps: monitor accounts and communications for unusual activity, be cautious of messages that appear to reference internal matters, and follow any official guidance the organisation issues. Change passwords on related accounts if you have not already, especially where credentials might have been stored or reused, and enable multi-factor authentication where available.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That check does not confirm or rule out involvement in this specific incident, but it offers a concrete way to see whether your details appear in previously compiled breach collections and to decide on further monitoring or protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.