Mount Vernon Mills Listed by avoslocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 26, 2022, Mount Vernon Mills, a textiles manufacturer headquartered in Mauldin, South Carolina, was listed by the ransomware group avoslocker. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and broader details about timing, method, and full scope have not been disclosed.

A listing on a ransomware leak site is a claim by the group, not independent confirmation of every asserted detail. Still, any incident involving exfiltrated internal files at a long-established manufacturer raises concrete questions for employees, partners, and others whose information may have been held in company systems.

Inside the incident

What is publicly recorded is limited. Mount Vernon Mills appeared on an avoslocker listing dated December 26, 2022. The available summary describes internal files as having been exfiltrated in a ransomware attack. No figure for individuals affected has been released. The precise date of initial access, the entry vector, whether encryption was deployed alongside theft, any ransom demand, and whether negotiations occurred are all undisclosed in the material at hand.

Ransomware incidents of this type commonly involve unauthorized access followed by data staging and removal before or during encryption. In this case, only the claim of internal-file exfiltration and the leak-site listing itself are stated. No inventory of systems, file counts, or confirmation of public release of the data beyond the listing has been provided in the reported facts.

The group behind it: avoslocker

Avoslocker is a ransomware operation that became widely documented in open reporting from roughly 2021 onward. Like many groups of that period, it has been associated with a double-extortion model: encrypting systems while also copying data and threatening to publish or auction it if payment is not made. The group has operated a leak site on which it names victims and, in some cases, posts samples or larger archives. It has been described in public technical reporting as functioning in a ransomware-as-a-service style, with affiliates carrying out intrusions.

Typical tactics attributed to avoslocker in broader industry reporting include exploitation of exposed remote-access services, use of commodity and custom tools for lateral movement, and pressure campaigns that combine operational disruption with the threat of data exposure. None of that general pattern should be read as a verified play-by-play of the Mount Vernon Mills incident. Regarding this victim, the facts support only that the group listed the organization and claimed internal files were taken. Any further assertion about what avoslocker specifically did or said in this case would go beyond the record.

About Mount Vernon Mills

Mount Vernon Mills was established in 1947 and is headquartered in Mauldin, South Carolina. It is a textiles manufacturer whose activities, according to the available summary, include producing chemicals, textiles, and related products. Companies in this sector typically maintain manufacturing operations, supply-chain relationships, product formulations, quality and compliance records, and the ordinary administrative systems that support a mid-to-large industrial workforce.

A breach at such an organization matters because textile and chemical manufacturing sits inside broader commercial and industrial networks. Internal files can touch employee records, customer and vendor contracts, shipping and logistics data, proprietary process information, and regulatory documentation. Even when the exact contents of a theft remain unconfirmed, the category of organization makes clear why partners and individuals connected to it have reason to pay attention.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown—such as whether the set included human-resources databases, financial ledgers, customer lists, intellectual property, or operational schematics—has been disclosed. The number of people affected is unknown.

Organizations of this kind commonly hold employee names and contact details, payroll and benefits data, vendor and customer account information, contracts, internal correspondence, and technical or production documentation. That is a general description of the sector, not a confirmed inventory of what was taken here. Until a fuller accounting is published by the company or by independent investigators, the exact contents remain unconfirmed. Readers should treat any specific claim about named data types beyond “internal files” as unverified unless corroborated by primary sources.

The real-world impact

For individuals, the practical risks depend on what the internal files actually contained. If employee or contractor personal data was included, possible outcomes include targeted phishing, identity fraud, or misuse of contact and employment details. If customer or vendor information was present, business email compromise and invoice fraud become more plausible. If proprietary or operational material was taken, the organization may face competitive harm, contractual disputes, or regulatory scrutiny—none of which is established as fact in the current record, but all of which are standard consequences in comparable industrial ransomware cases.

For Mount Vernon Mills itself, a ransomware event with claimed exfiltration can mean operational interruption, recovery costs, legal and notification obligations where personal data is involved, and reputational pressure from customers and suppliers. Because the scale and data types are not fully public, the severity for any given person or partner cannot be ranked with precision. The responsible posture is to assume that internal material left the environment and to reduce follow-on risk accordingly, without inflating what has been proven.

What to do if you're exposed

If you have a past or present connection to Mount Vernon Mills—as an employee, contractor, customer, or vendor—treat the incident as a prompt to tighten basic hygiene rather than as proof that your data is already in criminal hands. Concrete first steps include:

• Monitor financial and credit accounts for unfamiliar activity and consider a fraud alert if you have reason to believe personal identifiers were stored by the company.
• Be skeptical of unexpected emails, calls, or texts that reference the company, shipments, invoices, or HR matters; verify through known channels before clicking links or sending information.
• Change passwords on accounts that may have shared credentials or recovery paths tied to a work email, and enable multi-factor authentication where available.
• Retain any official notice you receive from the company; it may describe specific data elements and any support being offered.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, and review the results for reuse of the same password elsewhere.

Public detail on this incident remains limited. Further clarity, if it comes, will most likely arrive through official company statements or regulatory filings rather than through leak-site claims alone. Until then, measured caution is the proportionate response.

AICompiled with AI assistance from public sources and published under our editorial standards.