Florists Supply Ltd Listed by noescape Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In October 2023, Florists Supply Ltd, a western Canadian floral wholesaler, appeared on a listing associated with the noescape ransomware group. Public detail is limited: the number of people affected is unknown, and the only description of what was taken refers to internal files said to have been exfiltrated in a ransomware attack. For employees, suppliers, customers, and others whose information may sit in those systems, the practical question is whether personal or business data has been copied and could later be misused.

Because the listing itself is a claim by the group rather than an independently confirmed disclosure from the company, the full scope remains unclear. What is known is enough to warrant attention from anyone who has dealt with the firm, especially given how wholesale and logistics businesses typically store contact, order, and operational records.

Breaking down the breach

According to reporting dated October 23, 2023, Florists Supply Ltd was listed by the noescape ransomware group. The available summary states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of people affected, no precise date of intrusion or encryption has been released in the material at hand, and the technical method of entry is undisclosed. The incident is therefore known primarily through the group’s leak-site style claim rather than through a detailed official incident report.

Ransomware incidents of this type commonly involve unauthorized access, theft of data, and pressure applied by threatening to publish or sell what was taken. Beyond the statement that internal files were allegedly exfiltrated, further specifics—file volumes, exact systems touched, or whether encryption also disrupted operations—are not provided in the facts available here. Readers should treat the listing as an unverified claim unless and until the organisation or independent investigators confirm additional detail.

Who is noescape?

noescape was a ransomware operation that became publicly visible in 2023. Like several contemporaneous groups, it was associated with a double-extortion model: encrypting systems while also copying data and threatening to leak it on a dedicated site if a ransom was not paid. The group typically recruited affiliates, published victim names on a leak site, and used the prospect of public exposure as leverage. Its activity formed part of a broader wave of ransomware campaigns against mid-sized organisations across multiple sectors.

Well-documented public reporting on noescape describes standard ransomware tactics—initial access often via compromised credentials or vulnerable remote services, followed by lateral movement, data staging, and extortion notes. The group later wound down its public operations, but listings that appeared while it was active remain part of the public record of claimed victims. Nothing in the facts supplied here goes beyond the claim that Florists Supply Ltd was named on such a listing; no additional statements attributed to noescape about this specific victim are included.

About Florists Supply Ltd

Florists Supply Ltd is described as one of western Canada’s premier wholesalers of unique fresh flowers, floral supplies, giftware, and event décor, with locations including Winnipeg, Saskatoon, and other points in the region. Businesses of this kind sit in the middle of a supply chain that connects growers, importers, retail florists, event planners, and end customers. They routinely handle purchase orders, delivery schedules, account details for trade customers, and internal administrative records.

A breach at a regional wholesaler matters because the organisation’s systems often hold not only its own employee and financial data but also commercial information belonging to many smaller florists and event businesses that rely on it. Disruption or exposure can ripple outward through that network even when the exact contents of stolen files remain unconfirmed.

What was likely exposed

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No inventory of data types—such as names, addresses, financial account numbers, or customer lists—has been disclosed in the material provided. Exact contents are therefore unconfirmed.

Organisations in wholesale floral supply typically maintain employee records, vendor and grower contacts, trade-customer account information, invoices, shipping and logistics data, and internal correspondence. Any of those categories could fall under a broad label of “internal files,” but it would be inaccurate to state that specific fields were taken when public detail does not confirm them. Until a fuller disclosure appears, affected parties should assume that routine business and personnel information held by such a firm might be in scope, without treating any particular data element as proven.

Why it matters

For individuals, the real-world risk is ordinary but persistent: phishing or social-engineering attempts that reference real business relationships, fraud against trade accounts, or misuse of contact and identity details if those were present in the files. Employees and contractors may face heightened risk of targeted messages that appear to come from a familiar workplace context. Suppliers and retail florists who dealt with Florists Supply Ltd could see their own commercial information used to craft convincing scams.

For the organisation, consequences can include operational disruption, cost of investigation and recovery, contractual or regulatory notification duties where personal information is involved, and erosion of trust among the independent florists and event businesses that depend on a steady wholesale channel. Because the scale of the exfiltration and the precise data types remain undisclosed, the severity for any one person cannot be ranked from public facts alone; the prudent stance is to treat the claim seriously and reduce exposure where possible.

Were you affected?

If you are a current or former employee, supplier, or trade customer of Florists Supply Ltd, monitor accounts and communications for unusual activity, treat unexpected requests for payment or credentials with caution, and consider placing fraud alerts with relevant credit or banking services if you believe personal identifiers may have been involved. Change passwords on any accounts that reused credentials tied to work email, and enable multi-factor authentication where it is available. Keep records of any suspicious contact that appears to reference the company or your business relationship with it.

Public detail on this incident remains limited, and the number of people affected is unknown. Readers can run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets, which may help indicate whether further monitoring is warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.