KickDown ESET company. No overpayments at 0% (renamed and update) Listed by donutleaks Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a ransomware group claims to have taken internal files from an organisation, the immediate concern for ordinary people is whether their own personal or financial details are among those files and what that could mean for them in daily life. Public information about this incident remains limited, so anyone who has dealt with the named organisation has reason to pay attention and take basic protective steps while more details, if any, emerge.

On 21 July 2024 the ransomware group donutleaks listed an entity identified as KickDown ESET company. No overpayments at 0% (renamed and update) on its leak site, asserting that internal files had been exfiltrated. The number of people affected is unknown, and the precise contents of the files have not been independently confirmed.

What happened

According to the listing published by donutleaks, the group carried out a ransomware attack against KickDown ESET company. No overpayments at 0% (renamed and update) and exfiltrated internal files. The incident was reported on 21 July 2024. No further verified details about the timing of the intrusion, the technical method used, the volume of data taken, or any ransom demand have been made public. The group’s own note accompanying the listing states that the name now used for the entry is “KickDown ESET company. No overpayments at 0% (renamed and update)” and includes the claim that the actors compromised a new version of a premium home-security product before a pentest; the note also asserts that the matter is “not about us ‘making’ ESET.” These statements remain unverified claims by the group. Independent confirmation of the breach itself, beyond the leak-site listing, has not been published.

The group behind it: donutleaks

donutleaks is a ransomware operation that follows the familiar double-extortion model used by many such groups: after gaining access to a network they encrypt systems and simultaneously copy data, then threaten to publish the stolen material on a dedicated leak site if a ransom is not paid. The group typically posts short, often aggressive notes alongside victim names and sample file listings. Public reporting on donutleaks has documented a pattern of targeting organisations across various sectors and of using the leak site both as pressure and as a form of publicity. In this case the group claims to have listed KickDown ESET company. No overpayments at 0% (renamed and update) after an alleged ransomware attack; no independent verification of that claim has been released.

Who is KickDown ESET company. No overpayments at 0% (renamed and update)?

Publicly available information about an organisation operating under the exact name KickDown ESET company. No overpayments at 0% (renamed and update) is extremely limited. The wording of the listing and the accompanying note suggest a connection, at least in the group’s narrative, to cybersecurity or home-security software products associated with the better-known firm ESET; the note itself, however, insists the matter is not about “making” ESET. Organisations that develop or distribute security software commonly hold customer contact details, licence information, internal source code or configuration files, and operational records. A breach involving such an entity can therefore raise concerns for both individual users of related products and for the organisation’s own employees and partners. Because the precise identity and business activities of the named entity remain unclear from open sources, the full scope of potential impact cannot be assessed from public records alone.

The information in question

The only data type explicitly named in the available facts is “internal files exfiltrated in ransomware attack.” No inventory of those files, no count of records, and no confirmation of whether customer, employee or financial data were included have been published. Organisations working in software development or security products typically maintain source-code repositories, internal documentation, customer databases, support tickets and employee records. Whether any of those categories were among the files claimed by donutleaks is unconfirmed. Readers should therefore treat the exact contents as unknown pending further disclosure.

What's at stake

For individuals who may have interacted with the organisation, the practical risks include possible exposure of contact details, account credentials or other personal information that could later be used for phishing, identity fraud or unsolicited contact. Even if only internal technical files were taken, those materials can sometimes contain embedded credentials or configuration data that attackers reuse elsewhere. For the organisation itself, the consequences of a claimed ransomware incident typically include operational disruption, the cost of investigation and recovery, potential regulatory scrutiny, and damage to trust among customers and partners. Because the number of people affected remains unknown and the data types have not been detailed beyond “internal files,” the scale of these risks cannot yet be quantified.

What to do if you're exposed

Anyone who believes they may have had dealings with the named organisation should monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever possible, and change passwords that might have been reused. If you receive unexpected messages claiming to relate to this incident, treat them with caution and verify through official channels rather than links in the message. As a further practical step, readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan provides an early indication of whether personal information has circulated more widely.

AICompiled with AI assistance from public sources and published under our editorial standards.