Join us on RAMP Listed by revil Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 7 October 2021, the ransomware group REvil added an organisation named Join us on RAMP to its public leak site. The entry asserts that internal files were taken during a ransomware operation. No figure has been released for the number of people whose information may be involved, and the precise contents of the material have not been independently verified. This listing forms part of a wider shift in ransomware activity toward “double extortion,” in which operators encrypt systems and simultaneously threaten to release stolen data if a ransom is not paid.

Breaking down the breach

The only confirmed public detail is the appearance of Join us on RAMP on REvil’s leak site on the reported date. The group claims to have removed internal files; no further technical description of the intrusion method, duration, or volume of data has been disclosed. The number of affected individuals is stated as unknown.

The group behind it: revil

REvil is a ransomware operation that has conducted numerous campaigns since at least 2019. Its documented approach includes initial access through compromised remote-desktop services or phishing, deployment of encryption malware, and the use of a dedicated leak site to publish samples of stolen data when victims decline to pay. The group has been linked to earlier high-profile incidents against managed-service providers and large enterprises, after which law-enforcement actions in 2021 disrupted some of its infrastructure.

Join us on RAMP and its sector

Join us on RAMP is an organisation whose precise function is not detailed in public breach records. Entities of this type commonly maintain internal records that include employee data, operational documents, and client-related files. A successful intrusion that results in data exfiltration therefore carries implications for both the organisation’s own continuity and any third parties referenced in the stolen material.

What was likely exposed

The only category named in the available facts is “internal files.” No inventory of specific data fields—such as names, contact details, financial records, or credentials—has been published. Organisations in comparable sectors routinely store personnel files, contractual documents, and system configurations; however, whether any of these categories were present in the exfiltrated material remains unconfirmed.

What's at stake

Individuals whose information appears in internal files face the possibility that their details could be used for targeted phishing or sold on underground forums. For the organisation, the exposure of operational documents can complicate recovery efforts and may require notification to regulators or affected partners, depending on the jurisdiction and the nature of the data. The absence of a confirmed data count makes it difficult to quantify the scale of these risks at present.

Were you affected?

Begin by monitoring official statements from Join us on RAMP for any guidance it may issue. Individuals can also enter their email address into a reputable breach-checking service to determine whether the address has appeared in previously published data sets. If personal information is later confirmed as exposed, standard protective steps include enabling multi-factor authentication on important accounts and remaining alert for unsolicited messages that reference the incident.

AICompiled with AI assistance from public sources and published under our editorial standards.