IBC24 News Listed by hive Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The IBC24 News Listed by hive Ransomware Group (reported December 18, 2021) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
People connected to IBC24 News may face uncertainty over whether personal or professional details held in internal files have been taken and could later surface. On December 18, 2021, the organization was listed on a ransomware group's leak site, with the actors stating they had removed internal data during an attack. The number of individuals affected is not known, and no further details on the contents or reach of the material have been made public.
Breaking down the breach
The incident was identified through the listing of IBC24 News on the hive ransomware leak site. The group claims to have stolen internal data in a ransomware attack. No information has been released on when the intrusion occurred, how the attackers gained access, or the volume of material removed. The count of people whose information may be involved remains undisclosed.
The group behind it: hive
Hive is a ransomware operation that has carried out attacks on organizations in multiple countries and industries. Its documented pattern involves encrypting victim systems while also copying data, then using the threat of publication to pressure payment. The group maintains a site where it lists victims and sometimes posts samples of claimed material. In the present case, the listing of IBC24 News constitutes the group's own assertion that data was obtained; independent confirmation of the claim or its scope has not been provided.
IBC24 News and its sector
IBC24 News functions as a media outlet that produces reporting and maintains the supporting administrative and editorial records typical of such work. News organizations routinely store internal communications, staff details, contributor information, and operational files. A breach at an outlet of this kind can place those records at risk, affecting both the individuals named in them and the organization's ability to protect ongoing work.
What data was at risk
The only detail released is that internal files were allegedly exfiltrated. The specific categories of information contained in those files have not been disclosed. While news organizations commonly hold employee records, contact lists, and editorial materials, it is not confirmed whether any of these types of data were among the material taken.
The real-world impact
Individuals whose details appear in the exfiltrated files could see those details used in further attempts at fraud or targeted contact. The organization itself may experience continued operational strain while addressing the aftermath of the ransomware activity and reviewing its data-handling practices. Because the exact nature of the files remains unconfirmed, the practical consequences for any one person cannot yet be measured.
Were you affected?
Anyone who has worked with or supplied information to IBC24 News should watch accounts and communications for unexpected activity and update passwords on any linked services. Where personal data may be involved, standard steps include reviewing statements from banks or government services and placing fraud alerts if warranted. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances in published incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Metro.Us Listed by hive Ransomware GroupMediaMarkt Listed by hive Ransomware GroupOspray Video Listed by hive Ransomware GroupJAKKS Pacific Inc Listed by hive Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the IBC24 News Listed by hive Ransomware Group →
Publicly posted by hive — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.