NCH.COM Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 21, 2025, the ransomware group clop listed NCH.COM on its leak site, stating that internal files had been taken from the Australian software company. The number of individuals affected has not been disclosed, and no independent confirmation of the data’s contents or volume has been made public. People who have used NCH products or interacted with the company now have no clear information about whether their details were included in the exfiltrated material.

Inside the incident

The only confirmed detail is the listing itself. The group claims to have carried out a ransomware operation that resulted in the removal of internal files. No date for the intrusion, no description of the initial access method, and no figure for the number of records or files involved have been released by either the company or the group. Public statements from NCH.COM on the matter have not been recorded in available reporting.

The group behind it: clop

Clop is a ransomware operation that has conducted multiple campaigns since at least 2019. Its typical pattern involves encrypting systems and copying data before demanding payment, then posting victim names on a leak site when negotiations fail or deadlines pass. The group has previously claimed responsibility for intrusions at organisations in finance, manufacturing, and technology sectors. In this case the listing of NCH.COM stands as the group’s assertion; no separate verification of the claimed data has been published.

NCH.COM and its sector

NCH Software, based in Canberra, Australia, develops and distributes utility and productivity applications used worldwide. Its products include audio editing tools such as WavePad, file conversion software such as Switch, and document utilities such as Doxillion. Companies of this type routinely maintain customer account records, licence information, and internal business correspondence. A compromise at such a firm can therefore touch both corporate operations and the records of individual users who purchased or registered software.

What data was at risk

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific data categories has been supplied. Organisations in the software sector commonly hold customer names, email addresses, purchase histories, and support records; they also store employee data and proprietary development material. Without a confirmed list or statement from NCH.COM, it is not possible to state which of these categories, if any, were taken.

What's at stake

Exposed internal files can contain information that enables targeted fraud or account takeover if personal identifiers are present. For the company, the incident adds operational disruption and potential regulatory scrutiny under Australian privacy law. Individuals have no immediate way to assess their personal exposure until further details are released or the company issues a formal notification.

Were you affected?

Begin by monitoring official communications from NCH.COM for any customer notification. Review bank and email accounts for unusual activity. A free exposure scan of your email address against known breach data sets can indicate whether your information has appeared in previously published collections, though it cannot confirm presence in this specific incident.

AICompiled with AI assistance from public sources and published under our editorial standards.