Insport (sports store) Listed by revil Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 16, 2020, the ransomware group revil listed Insport, a sports store, on its leak site. The group claims to have exfiltrated internal files during a ransomware attack against the organization. The number of individuals whose information may be involved has not been disclosed. The incident is known only through the listing itself. No independent confirmation of the data volume, encryption status, or subsequent use of any files has been made public.

What happened

Insport appeared on the revil ransomware leak site on May 16, 2020. The listing states that internal files were taken from the company. No further technical details, such as the method of initial access or the timeline of the intrusion, have been released by either the group or the organization.

The scale of the operation remains unknown. Public records do not indicate how many records were removed or whether any data were later published elsewhere.

Inside revil

Revil is a ransomware operation that has been publicly tracked since 2019. The group typically gains access to corporate networks, deploys encryption on systems, and then posts samples of stolen material on a dedicated leak site to pressure victims into paying a ransom. Listings on that site represent the group’s assertion that data were obtained; independent verification of each claim is not always available.

The actor has appeared in multiple prior incidents involving retail and service organizations. Its pattern of operation centers on double-extortion: encryption combined with the threat of data release.

Who is Insport (sports store)?

Insport operates as a sports retailer. Organizations in this sector routinely maintain records that include customer purchase histories, payment details processed through point-of-sale systems, employee information, and supplier correspondence. A compromise at such a business can therefore touch both commercial operations and personal data belonging to shoppers and staff.

The listing of a retailer on a ransomware leak site draws attention because these businesses often hold recurring transaction data that can remain useful for fraud or identity-related misuse over time.

What was likely exposed

The only data category named in connection with the incident is internal files exfiltrated during the ransomware attack. No inventory of file types, record counts, or specific fields has been published.

Retail organizations of this kind commonly store customer names, contact details, order histories, and payment card information processed through third-party systems. Whether any of those categories were among the files referenced in the listing is unconfirmed.

Why it matters

Individuals whose records may have been held by Insport face the possibility that their information could circulate beyond the original breach. Internal files can contain operational details that indirectly identify customers or employees even when personal data are not the primary target.

For the organization, the event adds to the documented cases of ransomware activity against retailers in 2020. The absence of disclosed figures on affected individuals limits precise assessment of downstream impact.

What to do if you're exposed

Anyone concerned about possible involvement can begin by monitoring financial accounts and credit reports for unusual activity. Changing passwords on retail accounts and enabling multi-factor authentication where available reduces the chance of follow-on misuse.

Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in publicly referenced incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.