inocean.no / 2000 GB Listed by revil Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 9, 2021, the ransomware group revil listed inocean.no on its data-leak site and stated that it had taken internal files from the organisation. The number of individuals whose information may be involved remains unknown, and the company has not publicly confirmed the extent of any intrusion. For people connected to the organisation through employment, contracts or projects, the listing raises the possibility that documents created in the course of ordinary business could now circulate outside authorised channels.

Breaking down the breach

The only confirmed public record is the entry on revil’s leak site. The group claims to have exfiltrated internal files during a ransomware operation and to hold roughly 2000 GB of material. No independent verification of the volume, the date of the intrusion, or the precise method of access has been released. The organisation itself has not issued a statement detailing what, if any, systems were encrypted or whether ransom demands were received.

The group behind it: revil

Revil operated as a ransomware-as-a-service group whose affiliates deployed encryption malware and maintained a leak site to publish data when victims declined to pay. The group’s typical pattern involved initial network access through compromised remote-desktop services or phishing, followed by lateral movement, data collection and eventual deployment of ransomware. Revil was publicly linked to several high-profile incidents in 2020 and 2021 before its infrastructure was disrupted by law-enforcement actions later that year.

Who is inocean.no / 2000 GB?

Inocean.no is a Norwegian engineering firm whose work centres on marine and offshore structures. Organisations of this type routinely generate and store design specifications, client correspondence, project schedules, regulatory submissions and internal administrative records. A breach at such a company can therefore expose both proprietary technical material and personal data belonging to employees, contractors and business partners.

What data was at risk

The listing refers only to “internal files.” No inventory of specific data categories—such as names, national identification numbers, financial records or technical drawings—has been published. In the absence of a detailed disclosure, it is not possible to state with certainty which records were taken. Organisations in the marine-engineering sector commonly retain employee records, supplier contracts and project documentation; whether any of these were among the exfiltrated material remains unconfirmed.

What's at stake

Individuals whose details appear in internal files may face an elevated risk of targeted phishing or identity misuse if the material is later shared or sold. The organisation itself could encounter competitive harm if proprietary designs or client information circulates, along with regulatory scrutiny under Norwegian data-protection rules. Both outcomes depend on the actual contents of the files and on whether the material is ever publicly released or exploited.

If your data was in this claimed breach

Begin by monitoring official communications from inocean.no for any guidance it may issue. Enable multi-factor authentication on accounts that reuse passwords potentially contained in internal documents. Review bank and credit statements for unusual activity. A free exposure scan of your email address against known breach data can indicate whether your information has appeared in other incidents, providing a baseline for further vigilance.

AICompiled with AI assistance from public sources and published under our editorial standards.