Lowerys Listed by Storm Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to use public leak sites as pressure tools, posting company names and countdown-style claims whether or not those claims have been independently verified. In that climate, a new listing can alarm customers and staff long before anyone outside the claiming group has established what, if anything, occurred.

As of the reported date of September 09, 2026, the group known as Storm has listed Lowerys, a retail and e-commerce related business based in Thunder Bay, Ontario, on its leak site. The company has not publicly confirmed the claim as of writing. Public detail is limited: the number of people potentially affected is unknown, and the listing does not disclose specific data types. What follows treats Storm’s post as an unverified claim and explains what such a listing does and does not establish.

Inside the listing

According to the available record, Storm has listed Lowerys on its leak site under a headline framing the firm as a Storm ransomware group target. The reported summary places the organisation in retail and e-commerce, with operations tied to Thunder Bay and Fort Frances, Ontario, and describes Lowerys as a long-standing provider of office supplies, printing, photocopying, and related services.

Beyond that framing, concrete incident mechanics are undisclosed. The record does not state how access was supposedly obtained, whether encryption was involved, whether a ransom demand was made, what volume of material is alleged, or when any activity supposedly took place. People affected are listed as unknown. Data types named as exposed are not disclosed. In short, the public artifact is a named listing and a sector-and-location sketch of the business—not a confirmed inventory of stolen files or a verified timeline.

Readers should therefore separate three things a leak-site post can do: it can name a victim, it can threaten publication, and it can market pressure. It does not, by itself, prove that a breach occurred, that files left the organisation, or that any particular customer record is in criminal hands. Only confirmation from the company, a regulator, or other independent reporting would move those points from claim to established fact—and that confirmation is not part of the material provided here.

Inside Storm

Storm is known in public reporting as a ransomware and extortion-style actor that, like several peers, has used dedicated leak sites to name organisations and threaten to release material if demands are not met. Groups in this category typically blend intrusion, data theft claims, and public shaming; the leak site is part of the leverage, not a neutral archive.

Well-documented patterns among such actors include opportunistic targeting across many sectors, use of double-extortion narratives (encrypt systems and threaten data release), and recycling or exaggerating claims when it serves pressure. None of that general background proves what Storm did or did not obtain in relation to Lowerys. For this listing specifically, the only grounded statement is that the group has listed the company and that the accompanying public summary describes the business’s sector and location. Any assertion that Storm “stole” particular Lowerys files remains the group’s claim unless independently confirmed.

When a crew posts a name without transparent evidence, the listing still matters as a signal of intent and as a source of secondary risk—phishing that cites the listing, for example—but it is not the same as a forensic finding.

Who is Lowerys?

Lowerys is described in the reported summary as a provider of office supplies, printing, and photocopying services for businesses and individuals in Thunder Bay and Fort Frances, with additional offerings such as janitorial supplies, managed IT services, wide-format printing, and bottled water solutions. The same summary notes a long local history, emphasis on local shopping and price matching, headquarters at 540 Central Avenue, Thunder Bay, ON P7B 6B4, Canada, and a workforce in the 51–200 employee range.

Firms in this space sit at the intersection of retail, business services, and sometimes light IT support. They routinely handle commercial and consumer contact details, order and invoice records, payment-related information processed through normal retail channels, and internal staff and vendor data. Managed IT or printing workflows can also involve documents customers submit for reproduction. A credible incident affecting such a business would therefore matter not only to the firm’s continuity but to local organisations and households that rely on it for everyday supplies and document services. That consequence follows from the sector’s role; it does not require treating Storm’s listing as proven theft.

What was likely exposed

The facts state that data types named as exposed are not disclosed. It is therefore not possible to assert which systems or records, if any, left Lowerys’ control. Storm’s listing description of data—if any marketing language appears on the leak site beyond the summary given here—should be read as the attacker’s claim, not as an audited inventory.

If files were taken, organisations of this kind typically hold some mix of the following categories. Whether any of them were involved here remains unconfirmed:

• Customer and business contact details used for orders, accounts, and delivery
• Purchase, invoice, and loyalty or account history tied to retail and print jobs
• Payment-adjacent records (for example billing addresses or partial card metadata processed via normal commerce tools), depending on how checkout is run
• Employee and HR-related information for a mid-sized local workforce
• Vendor, supplier, and facilities-related records, including janitorial and water-service accounts
• Documents and files submitted for printing or photocopying, which can contain whatever the customer chose to reproduce
• Technical or support notes if managed IT services involve customer environment details

None of the items above are established as exposed in this case. They are the conditional backdrop for risk discussion when a retail and print provider is named and the listing stays silent on content.

The real-world impact

For people who shop or contract with Lowerys, the practical concern is conditional. If contact and order data were copied, common follow-on risks include targeted phishing that references real purchases or local business relationships, account-takeover attempts on reused passwords, and fraud that misuses names, addresses, or invoice patterns. If print-job files were among any taken material, sensitivity would depend entirely on what customers submitted—ranging from routine flyers to more private business or personal documents—and that content is not described in the public record.

For the organisation, a public extortion listing can disrupt operations through reputational stress, customer inquiries, and the cost of investigation even when the underlying claim is still unverified. Partners and employees may face the same uncertainty. None of that requires diagnosing Lowerys’ security programme; a leak-site name alone does not establish negligence, detection failures, or cultural priorities. It establishes that a known extortion brand has chosen to put the company on a pressure page, and that outsiders still lack confirmed scope.

Secondary harm is real even for false or inflated claims: criminals often ride news of listings with fake “breach support” calls, malicious attachments, or payment requests. Treat unsolicited outreach that cites Storm or Lowerys with skepticism unless it comes through verified company channels.

If your data was involved

Because neither the company confirmation nor a disclosed data inventory is part of the public facts here, act on a precautionary basis rather than on the assumption that your information is already public. If you are a Lowerys customer, employee, or vendor and you later learn that your records were implicated, standard first steps include monitoring account statements, changing passwords that might have been reused, enabling multi-factor authentication where available, and treating unexpected messages that reference invoices, print jobs, or “data recovery fees” as high-risk until verified. Prefer official contact paths you already trust over links or numbers supplied in cold email or chat.

If you used the same email address with Lowerys and elsewhere, you can run a free exposure scan of that email to check whether it has already appeared in other known breach datasets—useful context even when this particular listing remains unconfirmed. Keep expectations realistic: such scans reflect previously indexed incidents, not a live mirror of every extortion crew’s private stash, and they cannot prove or disprove Storm’s claim about Lowerys on their own.

Until Lowerys or an independent authority publishes verified detail, the accurate public position is narrow: Storm has listed the company; the firm has not publicly stated the incident as of writing; affected-person counts and data types remain unknown; and any personal response should stay conditional, practical, and free of panic driven solely by an unverified leak-site post.

AICompiled with AI assistance from public sources and published under our editorial standards.