Gitlabs: PT. ITPRENEUR INDONESIA TECHNOLOGY, GFZ Helmholtz Centre for Geosciences, LUA Cof... Listed by fog Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose information may sit inside the internal systems of PT. ITPRENEUR INDONESIA TECHNOLOGY, the GFZ Helmholtz Centre for Geosciences, or related entities now face the practical question of whether their work files, credentials, or personal details have been copied by criminals. On 1 February 2025 the ransomware group known as fog listed these organisations’ GitLab environments on its leak site and claimed to have stolen internal data. The number of people affected remains unknown, and public detail about the precise contents is limited, yet the claim alone is enough to warrant careful attention from anyone who has interacted with these institutions.

Ransomware incidents of this type typically involve both encryption of systems and the quiet removal of files for later publication or sale. Until more is confirmed, the safest assumption for potentially affected individuals is that internal material may no longer be under the sole control of the organisations that created it.

What happened

According to the available record, the organisations identified as Gitlabs: PT. ITPRENEUR INDONESIA TECHNOLOGY, GFZ Helmholtz Centre for Geosciences, LUA Cof... were listed on the fog ransomware group’s leak site on 1 February 2025. The group claims to have exfiltrated internal files during a ransomware attack. No further public information has been released about the date the intrusion began, the technical method used, the volume of data taken, or whether any ransom demand was met. The number of people whose data may be involved is listed as unknown. The listing itself constitutes an unverified claim by the threat actor; independent confirmation of the theft has not been supplied in the public facts.

Who is fog?

Fog is a ransomware operation that became publicly visible in 2024. Like many contemporary groups, it practises double extortion: after encrypting a victim’s systems it also steals data and threatens to publish the material on a dedicated leak site if payment is not received. The group typically posts short notices naming the organisation, sometimes accompanied by sample files, and later releases larger archives if negotiations fail. Fog has previously claimed victims across multiple sectors and geographies, though each listing must be treated as an assertion by the criminals rather than established fact. Public reporting has not attributed any specific technical innovation uniquely to fog; its methods appear consistent with common ransomware toolkits and social-engineering or vulnerability-exploitation entry points used by peer groups.

About Gitlabs: PT. ITPRENEUR INDONESIA TECHNOLOGY, GFZ Helmholtz Centre for Geosciences, LUA Cof...

The listed entities span technology services, earth-science research and related institutional activity. PT. ITPRENEUR INDONESIA TECHNOLOGY operates in the Indonesian information-technology sector, where companies commonly maintain source-code repositories, project documentation and client-related records. The GFZ Helmholtz Centre for Geosciences is a major German research institution focused on Earth sciences; such centres routinely hold scientific data sets, collaboration files, staff and visitor information, and administrative records. The remaining abbreviated names appear to refer to additional organisations whose GitLab instances were grouped in the same listing. GitLab platforms are widely used for version control, issue tracking and continuous-integration pipelines; they therefore frequently contain source code, configuration files, credentials, internal discussions and documents that would not normally be public. A compromise of these environments can expose both intellectual property and personal data of employees, contractors and research partners.

What data was at risk

The public facts state only that “internal files” were exfiltrated in a ransomware attack. No inventory of file types, no count of records, and no confirmation of personal identifiers have been disclosed. Organisations of this kind typically store source code, project plans, scientific data, employee directories, email archives, authentication tokens and contractual documents inside their GitLab instances. Whether any of those categories were among the stolen material remains unconfirmed. Until the organisations or independent investigators publish a verified list, the exact contents of the claimed data set cannot be stated as fact.

Why it matters

For individuals, the primary risks are identity misuse, targeted phishing that references real internal projects, and the possible exposure of private contact or financial details if such information was stored in the repositories. Researchers and staff may also face professional consequences if unpublished findings or proprietary methods appear online. For the organisations, the incident raises operational, legal and reputational concerns: restoration of systems, notification duties under applicable data-protection laws, and the longer-term loss of control over intellectual property. Because the number of affected people is unknown and the data types remain unspecified, the full scope of harm cannot yet be measured, but the combination of ransomware encryption and claimed data theft is sufficient to create lasting uncertainty for anyone connected to the listed entities.

What to do if you're exposed

If you have an account, employment relationship or research collaboration with any of the named organisations, treat the claim seriously. Change passwords and enable multi-factor authentication on any related accounts, monitor financial and email activity for unusual behaviour, and be sceptical of unexpected messages that reference internal projects. Organisations should be contacted through official channels for any formal breach notifications they may issue. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets; such a check provides an early warning even when the precise contents of a new incident remain unconfirmed.

AICompiled with AI assistance from public sources and published under our editorial standards.