RelationMedia A/S Listed by obscura Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

RelationMedia A/S, a Danish agency specialising in sales forces, merchandising, marketing and related services, has been listed by the ransomware group known as obscura. The listing was reported on 16 July 2025 and indicates that internal files were exfiltrated during a ransomware attack. The number of people affected remains unknown, and public detail on the precise scope and method of the incident is limited.

This development matters because organisations of this type routinely handle operational, client and field-collected information. When such data leaves controlled systems, the potential for misuse or further exposure exists even if the full contents have not been confirmed.

What happened

According to available reports, RelationMedia A/S appeared on the leak site associated with the obscura ransomware group on or around 16 July 2025. The group claims that internal files were exfiltrated as part of a ransomware attack. No further verified details have been released about the date the intrusion began, how access was obtained, the volume of data taken, or whether encryption was also deployed against the company’s systems. The number of individuals whose information may have been involved is listed as unknown. Public statements from RelationMedia A/S itself have not been incorporated into the available record, so the listing remains an unverified claim by the threat actor at this stage.

The group behind it: obscura

Obscura is a ransomware operation that follows the now-common double-extortion model: operators gain access to a network, exfiltrate data, and then encrypt systems while threatening to publish the stolen material if a ransom is not paid. The group maintains a dedicated leak site where it posts victim names and, in some cases, sample files to pressure organisations. Public reporting on obscura has documented its use of standard initial-access techniques such as phishing, exploitation of unpatched remote-access services, and the purchase of credentials from initial-access brokers. Once inside, the group typically moves laterally, escalates privileges, and stages data for extraction before deploying ransomware. Prior listings by obscura have involved companies across multiple sectors and geographies; the group does not appear to specialise exclusively in one industry. In the present case, the only specific claim made about RelationMedia A/S is the listing itself and the assertion that internal files were taken. No additional statements from the group about this victim have been recorded in the facts available.

Who is RelationMedia A/S?

RelationMedia A/S describes itself as a leading agency in Denmark operating in sales-force management, merchandising, marketing, data collection, sampling, product presentation and events. Companies in this sector typically act as intermediaries between brands and retail or consumer environments. They coordinate field teams, gather point-of-sale and consumer data, manage promotional campaigns, and handle logistics for product sampling and events. As a result they often hold contracts with multiple client brands, maintain databases of retail locations and personnel, and process information generated by temporary or contracted staff. A breach at such an organisation can therefore touch both the agency’s own internal records and material belonging to its clients and field workers. The Danish market context means the company is subject to European data-protection rules, which place legal obligations on controllers and processors when personal data is compromised.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No more granular inventory—such as employee records, client contracts, financial documents, or field-collected consumer data—has been publicly confirmed. Organisations of this type commonly store personnel details for sales and merchandising staff, client contact lists, campaign plans, inventory or sampling schedules, and any data gathered during product presentations or events. Because the precise contents remain undisclosed, it is not possible to state with certainty which of these categories, if any, were among the files taken. The absence of a confirmed data inventory means affected parties cannot yet determine the exact nature of their exposure.

Why it matters

For individuals whose information may have been among the internal files, the practical risks include targeted phishing, identity misuse, or unwanted contact if contact details or employment records were present. Field staff and temporary workers are often less protected by corporate monitoring and may be slower to notice anomalous activity. For RelationMedia A/S the consequences include potential regulatory scrutiny under data-protection law, contractual obligations to notify clients, and the operational cost of investigating and remediating the incident. Clients who entrusted campaign or consumer data to the agency may themselves face secondary notification duties. Even when encryption is not confirmed, the mere exfiltration of internal files can erode trust and create long-term reputational and legal exposure. Because the scale remains unknown, the full extent of these risks cannot yet be quantified.

Were you affected?

If you have worked for, contracted with, or supplied data to RelationMedia A/S, treat the possibility of exposure seriously until more information emerges. Monitor financial and email accounts for unexpected activity, enable multi-factor authentication where available, and be cautious of unsolicited messages that reference the company or recent campaigns. Consider placing fraud alerts with relevant credit agencies if you believe personal identifiers may have been involved. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official confirmation from RelationMedia A/S or Danish authorities, if and when it arrives, will provide the most reliable guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.