ICC Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 22, 2024, the ransomware group known as rhysida listed ICC on its leak site, claiming to have carried out a ransomware attack that involved the exfiltration of internal files. Public detail remains limited: the number of people affected is unknown, and no further confirmation of the claim has been widely reported. ICC is a manufacturer of structured cabling solutions, producing copper and fiber optic connectivity products for commercial and residential use. The listing itself is an unverified claim by the group; what is known so far is that internal files were named as the material taken in the attack.

For anyone connected to ICC—employees, partners, or customers—the incident raises practical questions about what may have left the organisation’s systems and how that information could be misused. Because the scale and exact contents have not been disclosed, the situation calls for careful attention rather than assumption.

Breaking down the breach

According to the available record, ICC was listed by the rhysida ransomware group on May 22, 2024. The group’s claim states that internal files were exfiltrated as part of a ransomware attack. No public figures have been given for the volume of data, the number of systems involved, or the precise method of initial access. Timing of the intrusion itself, beyond the date the listing appeared, is undisclosed. The people affected remain unknown. In short, the incident is known primarily through the group’s leak-site claim and the description of internal files as the material taken; independent verification of the full scope has not been detailed in the public record.

Who is rhysida?

Rhysida is a ransomware operation that became publicly visible in 2023. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. The group maintains a leak site where it posts victim names and, in some cases, samples of stolen material. Its targets have spanned multiple sectors and countries. Public reporting has associated rhysida with the use of common initial-access techniques and with the packaging of stolen data for pressure. In this case, the group claims ICC as a victim and asserts that internal files were exfiltrated; that claim should be treated as such until corroborated by the organisation or independent investigation.

ICC and its sector

ICC manufactures structured cabling solutions—copper and fiber optic connectivity products used in commercial buildings and residential installations. Organisations of this kind sit in the broader industrial and technology supply chain, supplying the physical infrastructure that carries network traffic. They typically hold engineering drawings, product specifications, customer and distributor lists, order and shipping records, employee information, and internal operational documents. A breach at a manufacturer can affect not only the company itself but also the partners and end users who rely on its products and the confidentiality of project or commercial data. Because the sector deals with both technical designs and business relationships, the potential sensitivity of internal files is clear even when exact contents remain unconfirmed.

What was likely exposed

The facts name only “internal files exfiltrated in ransomware attack.” No further breakdown of file types, databases, or personal data categories has been disclosed. Organisations in manufacturing and cabling typically retain design files, bills of materials, customer and supplier contact details, contracts, financial records, and human-resources material. Whether any of those categories were among the files taken is unconfirmed. The exact contents of the claimed exfiltration are therefore unknown; public detail is limited to the group’s assertion that internal files left the environment.

The real-world impact

For individuals whose information may have been among the internal files, risks include targeted phishing, social-engineering attempts that reference real projects or colleagues, and, if personal data was present, longer-term identity or account misuse. For the organisation, consequences can include operational disruption, loss of competitive technical information, strained partner relationships, and the cost of investigation and remediation. Because the number of people affected is unknown and the precise data types are not listed, the impact remains a matter of potential rather than measured harm. The listing itself can also create reputational pressure regardless of whether the full data set is ever published.

If your data was in this claimed breach

If you have a past or present connection to ICC—as an employee, contractor, customer, or supplier—treat the situation as a prompt for basic hygiene rather than panic. Concrete first steps include:

• Change passwords on any accounts that reused credentials linked to work email or systems, and enable multi-factor authentication where available.
• Watch for unexpected messages that reference ICC projects, invoices, or colleagues; verify requests through a separate channel before acting.
• Review financial and credit activity if you believe personal identifiers may have been involved, and place freezes or alerts with credit bureaus if appropriate in your jurisdiction.
• Keep software and devices updated, and be cautious with attachments or links even from seemingly familiar senders.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Public detail on this particular incident remains limited; staying informed through official statements from ICC, if any are issued, is the most reliable way to learn whether further action is required.

AICompiled with AI assistance from public sources and published under our editorial standards.