ISC Listed by cactus Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 17 November 2023, the engineering firm ISC appeared on a leak site operated by the ransomware group known as cactus. Public detail is limited: the number of people affected has not been disclosed, and the only description of what was taken refers to internal files said to have been exfiltrated in a ransomware attack. For employees, contractors, clients and partners whose information may sit inside those systems, the practical question is straightforward—what, if anything, of theirs is now in unauthorised hands, and what should they do about it.

Because the listing itself is a claim by the group rather than an independently confirmed disclosure from the company, the full scope remains unclear. Still, any organisation that designs and supports offshore energy projects holds material that can be sensitive for both commercial and personal reasons. Understanding what is known—and what is not—helps people judge their own exposure without relying on speculation.

What happened

According to the available record, ISC was listed by the cactus ransomware group on 17 November 2023. The report states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of individuals affected, no inventory of specific file types or systems has been released in the material provided, and the precise method of initial access has not been disclosed. Timing beyond the reporting date, any ransom demand, and whether data was later published or sold are likewise unconfirmed in the facts at hand.

In short, the incident is known principally through the group’s leak-site claim and the characterisation that internal files were taken. Independent verification of volume, content and impact has not been supplied in the record used for this account.

Who is cactus?

Cactus is a ransomware operation that emerged in public reporting in 2023. Like other groups in this category, it is associated with double-extortion tactics: encrypting systems to disrupt operations while also copying data and threatening to release or auction it if payment is not made. The group has been observed targeting a range of organisations across sectors, often advertising victims on a dedicated leak site as leverage.

Public technical write-ups have described cactus tooling that can disable security products, move laterally inside networks, and package stolen data for exfiltration before encryption. Those patterns are drawn from broader industry reporting on the actor, not from confirmed forensics specific to ISC. With respect to this incident, the only direct assertion in the record is the group’s listing of ISC and the claim that internal files were exfiltrated. That listing should be treated as an unverified claim unless and until the organisation or independent investigators corroborate it.

About ISC

ISC is an engineering-services company based in Denmark, with an address in Esbjerg and operations that extend internationally. Public description of the firm emphasises design and engineering solutions for offshore projects, including a long-standing presence in offshore wind—dating to work on early offshore substations—and activity in renewable energy as well as oil and gas. Reported revenue is approximately $60.1 million. Its website is www.isc.dk.

Firms of this type typically sit at the intersection of industrial design, project delivery and client confidentiality. They handle technical drawings, project schedules, supplier and contractor details, and correspondence that can include personal data of staff and external partners. A breach affecting such an organisation matters because the same systems that support complex offshore engineering often also store identity, contact and contractual information that outsiders could misuse, and because disruption or leakage can affect safety-critical or commercially sensitive workstreams.

What was likely exposed

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No further breakdown—such as employee records, client lists, financial documents, engineering drawings or authentication data—has been provided. The number of people affected is unknown.

Organisations in engineering and offshore energy commonly hold personnel files, email and messaging archives, project documentation, vendor contracts, and credentials or access information for internal tools. Any of those categories could in principle appear among “internal files,” but that remains an inference about the sector, not a claimed inventory for this incident. Exact contents are unconfirmed; readers should not assume specific data types were or were not taken.

What's at stake

For individuals, the main risks are the ordinary consequences of internal business data leaving trusted control: phishing or social-engineering attempts that reference real projects or colleagues, exposure of contact details or identity information if such data were present, and, in some cases, longer-term concerns if financial or authentication material was included. Because the precise contents are undisclosed, people connected to ISC cannot yet rule exposure in or out with certainty.

For the organisation, stakes include operational disruption from ransomware, potential contractual or regulatory obligations to notify partners and authorities, reputational harm, and the possibility that proprietary engineering or commercial information could be misused by competitors or other third parties. None of these outcomes is established as fact solely by a leak-site listing; they are the concrete risks that follow when internal files are claimed to have been stolen.

Were you affected?

If you work or have worked with ISC, or if you are a client, supplier or partner, treat the situation as a prompt to tighten routine defences rather than as proof that your personal data is already public. Change passwords on accounts that may have been used in connection with the company, enable multi-factor authentication where it is available, and be wary of unexpected messages that cite offshore projects, invoices or internal contacts. Monitor financial and email accounts for unusual activity.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That check will not confirm or deny involvement in this specific incident, but it can show whether your address has surfaced elsewhere and help you prioritise further steps. Public detail on the ISC listing remains limited; official notices from the company, if issued, should be read carefully for any confirmed scope and guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.