On IT Listed by termite Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target technology service providers as a way to reach multiple client organisations at once, turning a single compromise into broader supply-chain risk. Against that backdrop, the listing of On IT by the termite ransomware group on 10 April 2025 adds another name to a lengthening roster of IT firms whose internal systems have been claimed as breached.

Public reporting states that On IT, a provider of managed IT and digital-transformation services, has been named on the group’s leak site following an alleged ransomware attack in which internal files were exfiltrated. The number of people affected remains unknown, and independent confirmation of the full scope has not been released. The incident matters because organisations that handle client systems and data sit at a sensitive intersection of operational and privacy risk.

Breaking down the breach

According to the available record, On IT was listed by the termite ransomware group on 10 April 2025. The group claims that internal files were exfiltrated during a ransomware attack. No further technical detail—such as the initial access vector, the duration of unauthorised access, the precise volume of data taken, or whether systems were encrypted—has been publicly disclosed. The number of individuals whose information may have been involved is listed as unknown. At present the listing itself constitutes the principal public claim; independent verification of the group’s assertions has not been published.

The group behind it: termite

Termite operates as a ransomware actor that, like many contemporary groups, combines data theft with the threat of public release. Public reporting on the group’s broader activity describes a pattern of targeting organisations, exfiltrating files, and posting victim names on a dedicated leak site to apply pressure. The group’s claims about any specific victim, including On IT, should be treated as unverified assertions until corroborated by the organisation itself or by independent investigation. No additional statements attributed to termite about this particular incident appear in the public record beyond the listing and the assertion that internal files were taken.

On IT and its sector

On IT is described as a provider of information-technology services focused on digital transformation for enterprises. Its offerings include managed services for small and medium-sized enterprises, data analysis using Power BI, digital project management, technical training, and IT support. Firms in this sector routinely hold credentials, configuration data, client contact details, project documentation, and sometimes access pathways into customer environments. A compromise at such a provider can therefore extend beyond the firm’s own staff to the organisations that rely on its services, amplifying both operational disruption and privacy exposure.

The information in question

The public facts state only that internal files were exfiltrated in a ransomware attack. Exact data types, file counts, and whether personal information of employees or clients was included have not been disclosed. Organisations of this kind typically maintain internal documents, system inventories, client correspondence, training materials, and operational records; some of those materials may contain personal or commercially sensitive data. Because the precise contents remain unconfirmed, any assessment of what was taken must remain provisional.

Why it matters

For individuals whose details may appear in the exfiltrated files, the practical risks include targeted phishing, credential stuffing, or social-engineering attempts that leverage knowledge of internal projects or contacts. For On IT itself, the incident raises questions of operational continuity, client trust, and potential regulatory notification obligations, depending on the jurisdictions involved and the nature of any personal data. Clients of the firm may also need to reassess access controls and monitoring if shared systems or credentials were among the materials taken. None of these outcomes is certain on the basis of the current public record; they represent the ordinary range of consequences that follow when an IT service provider is claimed as a ransomware victim.

Were you affected?

If you are an employee, contractor, or client of On IT, monitor official communications from the company for any notification or guidance. Consider changing passwords used in connection with the firm’s services, enabling multi-factor authentication where available, and remaining alert to unexpected messages that reference internal projects or contacts. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Public detail on this incident remains limited; further clarity will depend on any statements released by On IT or by independent investigators.

AICompiled with AI assistance from public sources and published under our editorial standards.