Measuresoft Listed by mallox Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 3 October 2023, Measuresoft appeared on the leak site operated by the mallox ransomware group. The group claims to have stolen internal data from the company in a ransomware attack. Public detail remains limited: the number of people affected is unknown, and no independent confirmation of the intrusion or the precise contents of any stolen material has been released.

Listings of this kind matter because they signal a potential compromise of organisational systems and data. Until more information surfaces from the company or investigators, the claim itself is the primary public record of the incident.

What happened

Measuresoft was listed on the mallox ransomware leak site on or around 3 October 2023. According to the group's own statement accompanying the listing, internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access method, the duration of any unauthorised presence on the network, the volume of data taken, or whether encryption was also deployed—have been disclosed in public reporting tied to this incident. The number of individuals whose information may be involved is likewise unknown. The listing constitutes a claim by the threat actors rather than a verified disclosure by Measuresoft or law-enforcement sources.

Who is mallox?

Mallox is a ransomware operation that has been active for several years and is documented in public threat-intelligence reporting. The group typically focuses on Windows environments, frequently gaining initial access through exposed or weakly protected Microsoft SQL Server instances and other remote-access services. Once inside a network, mallox operators are known to move laterally, disable security tools, exfiltrate data, and then deploy ransomware encryptors as part of a double-extortion model. Victims are pressured both by the encryption of systems and by the threat of publishing stolen files on a dedicated leak site if a ransom is not paid.

Mallox has previously listed organisations across manufacturing, technology, healthcare and professional services. The group’s leak-site posts usually include sample files or directory listings intended to demonstrate access, though the authenticity and completeness of any particular claim must be treated with caution until corroborated. In the present case, the only public assertion is that Measuresoft’s internal data was taken; no additional victim-specific statements from the group beyond that claim are part of the available record.

Measuresoft and its sector

Measuresoft is a software company that develops industrial automation and data-acquisition products, notably SCADA and HMI solutions used to monitor and control processes in manufacturing, energy, utilities and related industrial settings. Organisations of this type routinely hold proprietary source code, customer configuration data, technical documentation, internal business records, employee information and contractual material belonging to clients who operate critical or sensitive infrastructure.

A breach affecting a vendor in the industrial-software supply chain carries wider consequences than a purely internal corporate incident. Customers may rely on the vendor’s software for operational visibility and control; any compromise of development systems, update mechanisms or customer-support databases can raise questions about the integrity of delivered products and the confidentiality of client environments. Even when the precise scope remains unconfirmed, the sector’s role in operational technology makes such listings noteworthy for both the company and its user base.

The information in question

The only data category named in connection with the incident is “internal files” said to have been exfiltrated. No inventory of specific file types, databases, personal-data categories or customer records has been published. Public detail on the exact contents is therefore unconfirmed.

Companies in Measuresoft’s position typically maintain source-code repositories, build systems, customer project files, licensing databases, employee records, financial documents and internal communications. Whether any of these were among the material the attackers claim to hold has not been established. Until Measuresoft or independent investigators provide a verified description, it is not possible to state what was actually taken.

The real-world impact

For individuals whose data might be contained in internal files—employees, contractors or customer contacts—the practical risks include potential exposure of names, contact details, employment information or correspondence. Such material can be misused for targeted phishing, identity fraud or social-engineering attempts. Because the volume and nature of any personal data remain unknown, the scale of this risk cannot yet be quantified.

For Measuresoft itself, the consequences of a claimed ransomware incident typically include operational disruption, forensic and recovery costs, possible regulatory notification duties, and reputational damage with customers who depend on the integrity of industrial software. Clients may also face secondary concerns if proprietary configurations or credentials were stored in the vendor’s systems. At present these remain potential rather than demonstrated impacts, pending further disclosure.

No public statements confirming ransom demands, payment, or the release of files beyond the initial listing claim have been recorded in the available facts.

Were you affected?

If you are a current or former employee, contractor or customer of Measuresoft, monitor official communications from the company for any notification or guidance. Treat unsolicited emails or calls that reference the incident with caution, as criminals often exploit breach news for phishing. Consider changing passwords for any accounts that may have been used in connection with Measuresoft services, and enable multi-factor authentication where available. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Keep records of any suspicious contact and report confirmed misuse of personal information to the relevant authorities in your jurisdiction.

AICompiled with AI assistance from public sources and published under our editorial standards.