Orion Communications and Public Relations Listed by brotherhood Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On October 10, 2025, the ransomware group known as brotherhood listed Orion Communications and Public Relations on its leak site, claiming responsibility for a ransomware attack in which internal files were exfiltrated. Public reporting indicates the material consists of 13 Gb of compressed files and databases. The number of people affected remains unknown, and further details about the incident have not been confirmed.

This listing places the communications firm among the organisations whose data has been claimed by the group. Because the precise scope and contents are limited to what the group has asserted, the situation warrants careful attention from anyone connected to the firm while awaiting additional verified information.

Breaking down the breach

According to the available record, Orion Communications and Public Relations was listed by the brotherhood ransomware group on October 10, 2025. The group claims that internal files were exfiltrated during a ransomware attack and that the material comprises 13 Gb of compressed files and databases. No further public detail has been provided on the method of intrusion, the exact timing of the attack, or whether systems were encrypted in addition to the claimed data theft. The number of individuals whose information may be involved is listed as unknown. As with any leak-site posting, the listing itself constitutes a claim by the group rather than independently verified confirmation of every detail.

Inside brotherhood

Brotherhood is a ransomware group that operates in the established pattern of double-extortion actors: after gaining access to a network, the group typically exfiltrates data and then threatens to publish it on a dedicated leak site if a ransom is not paid. Such groups commonly advertise victims by name, volume of data, and high-level descriptions of the material taken, using the threat of public release as leverage. Prior activity associated with brotherhood and similar operators has involved listings of organisations across multiple sectors, with claims of databases, internal documents and other corporate files. In this case the group claims Orion Communications and Public Relations as a victim and describes the material as 13 Gb of compressed files and databases; no additional statements attributed specifically to this incident beyond that listing are part of the public record.

Who is Orion Communications and Public Relations?

Orion Communications and Public Relations is a firm operating in the public-relations and communications sector. Organisations of this type typically manage client campaigns, media relations, internal strategy documents, contact lists and correspondence on behalf of businesses, nonprofits or public figures. They routinely hold sensitive commercial information, personal contact details of clients and media partners, and proprietary materials that support reputation management and messaging work. A breach involving such a firm is consequential because the data often extends beyond the company’s own employees to the clients and partners who entrust it with confidential communications. Any compromise can therefore affect multiple organisations and individuals who rely on the firm’s discretion.

The information in question

The facts state that internal files were exfiltrated and that the claimed material consists of 13 Gb of compressed files and databases. No more granular inventory of data types—such as specific categories of personal information, client records or financial details—has been disclosed. Public-relations firms commonly store employee records, client contracts, media contact databases, campaign plans and internal correspondence. Because the exact contents remain unconfirmed beyond the group’s high-level description, it is not possible to state with certainty which of these categories, if any, are present in the claimed archive. Readers should treat the 13 Gb figure and the reference to files and databases as the group’s assertion rather than an independently audited inventory.

The real-world impact

For individuals whose information may appear in the material, the primary risks include potential misuse of contact details, exposure of professional correspondence, or secondary social-engineering attempts that leverage knowledge of internal relationships. Clients of the firm could face reputational or competitive harm if proprietary strategy documents or media plans become public. For Orion Communications and Public Relations itself, the incident raises operational concerns around client trust, possible regulatory notification duties, and the cost of forensic investigation and remediation. Because the number of affected people is unknown and the precise data elements are unconfirmed, the scale of these risks cannot yet be quantified. The situation remains one of claimed exposure rather than fully mapped impact.

Were you affected?

If you have worked with, been employed by, or otherwise shared personal or professional information with Orion Communications and Public Relations, treat the listing as a prompt for caution. Monitor accounts for unusual activity, enable multi-factor authentication where available, and be alert to phishing messages that reference the firm or its clients. Change passwords on any accounts that may have been reused. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official confirmation from the organisation or law-enforcement sources, if and when it becomes available, should guide any further steps.

AICompiled with AI assistance from public sources and published under our editorial standards.