PENS.COM Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by claiming data theft and threatening public leaks, a pattern that has become a routine feature of the current cyber-threat landscape. In this environment, even mid-sized commercial firms can find themselves named on leak sites, leaving customers and partners to assess what, if anything, may have been exposed.

On 13 November 2025, the ransomware group known as clop listed PENS.COM among its claimed victims. Public detail remains limited: the number of people affected is unknown, and the only information provided is that internal files were said to have been exfiltrated. The listing itself is a claim by the group and has not been independently confirmed in the available record.

What happened

According to the reported facts, PENS.COM was listed by the clop ransomware group on 13 November 2025. The group asserts that internal files were exfiltrated in a ransomware attack. No further operational details—such as the initial access method, the precise date of intrusion, the volume of data taken, or whether systems were encrypted—have been disclosed in the public summary. The number of individuals potentially affected is listed as unknown. Because the information originates from a threat-actor leak-site claim, it should be treated as unverified until corroborated by the organisation or independent investigators.

The group behind it: clop

Clop is a well-documented ransomware operation that has been active for several years. The group typically employs a double-extortion model: after gaining access to a network, operators exfiltrate data and then demand payment under threat of publishing the material on a dedicated leak site. Clop has previously been associated with large-scale campaigns that exploited vulnerabilities in widely used file-transfer software, as well as more conventional intrusion methods such as phishing and exploitation of unpatched systems. Public reporting has linked the group to attacks on organisations across multiple sectors, including manufacturing, professional services and retail. In each case the group’s public statements are claims; confirmation of any specific victim’s compromise rests with the organisation itself or with law-enforcement and forensic findings. No additional statements by clop about PENS.COM beyond the listing itself appear in the available facts.

About PENS.COM

PENS.COM is a promotional-products company that specialises in customisable items such as personalised pens, logoed bags and other branded office merchandise. It serves businesses and professionals seeking to raise brand visibility through customised giveaways and corporate gifts. The company operates primarily online, allowing customers to design and order products through its website. Organisations of this type routinely hold customer account details, order histories, shipping addresses, payment-related information and internal business records. A breach involving such a firm can therefore affect both the company’s own operations and the commercial customers who rely on it for branded materials. Public detail on the precise scope of any compromise at PENS.COM remains limited.

The information in question

The facts state only that internal files were exfiltrated in a ransomware attack. No specific categories of personal or commercial data—such as names, email addresses, financial records or employee information—have been named. For a promotional-products business, internal files could in principle include customer order databases, design files, supplier contracts, employee records or operational documents. Because the exact contents have not been disclosed, any assertion about particular data types would be speculative. The public record simply does not confirm what was taken or whether any of it has been published.

What's at stake

If internal files were indeed removed, the practical risks depend on what those files contained. Customers might face secondary phishing or social-engineering attempts that reference genuine order details. Business clients could see proprietary branding materials or pricing information misused. For the company itself, the consequences may include operational disruption, reputational harm and the cost of forensic investigation and customer notification. Because the number of people affected is unknown and the data types remain unconfirmed, the scale of any individual harm cannot yet be quantified. The absence of confirmed detail does not eliminate risk; it simply means that affected parties must proceed on the basis of caution rather than certainty.

Were you affected?

If you have ordered from or supplied PENS.COM, monitor account statements and email for unexpected activity. Consider changing passwords associated with the company’s site and enabling multi-factor authentication where available. Watch for phishing messages that reference past orders or promotional products. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Until PENS.COM or independent investigators provide further confirmation, treat the clop listing as an unverified claim and take proportionate protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.