forabank.ru Listed by werewolves Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target financial institutions as part of a broader pattern of double-extortion attacks, in which data is stolen and publication is threatened unless a payment is made. Listings on criminal leak sites have become a routine pressure tactic, even when independent confirmation of the underlying intrusion remains limited. Against that backdrop, a December 2023 claim involving a Russian bank illustrates how quickly such allegations can surface and why they matter to customers and counterparties.

On 15 December 2023, the ransomware group known as werewolves listed forabank.ru, the online presence of АКБ «ФОРА-БАНК» (АО). Public reporting states that internal files were exfiltrated in a ransomware attack and that the group sought payment to withhold publication. The number of people affected is unknown, and many operational details have not been independently confirmed.

What happened

According to the available record, forabank.ru was listed by the werewolves ransomware group on 15 December 2023. The report describes internal files as having been exfiltrated in a ransomware attack. The group’s associated claim set a price of 450000$ for non-publication and deletion of the compromised information. No verified figure for the number of individuals affected has been published, and public detail does not describe the initial access method, the duration of any intrusion, or whether systems were encrypted in addition to data theft. The listing itself remains a claim by the group rather than a fully corroborated technical disclosure.

The group behind it: werewolves

Werewolves is a ransomware actor that has operated in the double-extortion model familiar from other contemporary groups: data is stolen, victims are pressured with the threat of leak-site publication, and a ransom is demanded for suppression or deletion of the material. Like peer crews, the group has used dedicated leak infrastructure to name organisations and to post samples or fuller archives when negotiations stall. Public tracking of such actors generally notes opportunistic targeting across sectors rather than exclusive focus on any single industry. For this incident, the only specific assertions tied to forabank.ru are those contained in the listing and the accompanying demand; no further statements by the group about this victim are part of the provided record, and the claim should be treated as unverified until corroborated by the organisation or independent investigators.

forabank.ru and its sector

АКБ «ФОРА-БАНК» (АО) is a Russian credit institution registered with the Bank of Russia on 27 May 1992 and included in the register of the mandatory deposit insurance system. It presents itself as a large universal financial institution, offering settlement and cash services and a broad range of products for individuals and legal entities, as well as operations on currency and securities markets. The bank participates in the international payment systems VISA and MasterCard. Banks of this type routinely hold extensive customer identity and contact data, account and transaction records, corporate client information, and internal operational documents. A claimed compromise at such an institution is consequential because financial data is both sensitive for fraud and valuable for further social-engineering or identity misuse, and because trust in payment and deposit services depends on the integrity of back-office systems.

What data was at risk

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No inventory of specific file categories, customer fields, or record counts has been disclosed in the public summary. Organisations in this sector typically maintain customer onboarding documents, account details, transaction histories, employee records, and internal correspondence; whether any of those categories were among the files taken in this case is unconfirmed. Readers should therefore treat the precise contents as unknown pending official clarification from the bank or regulators.

Why it matters

If internal banking files were copied, affected individuals and companies could face elevated risk of targeted phishing, credential stuffing, or fraudulent payment instructions that exploit knowledge of real account relationships. Even without public release of full datasets, the mere assertion of exfiltration can enable scammers to impersonate the bank or its staff with greater credibility. For the institution, a ransomware claim raises operational, regulatory, and reputational issues common to the financial sector, including potential notification duties and the need to validate the integrity of customer-facing channels. Because the scale of any exposure remains unknown, the practical impact cannot yet be quantified, but the combination of a named financial victim and a stated ransom demand underscores why such incidents receive close attention from customers and supervisors alike.

If your data was in this claimed breach

If you hold accounts or have done business with ФОРА-БАНК, monitor statements and alert channels for unusual activity, and treat unsolicited requests for credentials, codes, or urgent payments with caution—even if the sender appears familiar with your relationship to the bank. Consider changing online-banking passwords and enabling the strongest available multi-factor authentication. Preserve any suspicious messages for reference. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach datasets, which may help you prioritise further monitoring and password updates across other services.

AICompiled with AI assistance from public sources and published under our editorial standards.