RFF.ORG Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When an organisation that works on public policy and research appears on a ransomware group's leak site, the immediate question for staff, partners, and anyone who has shared information with it is simple: what of mine might now be in someone else's hands? Public detail on the RFF.ORG incident is limited, yet the listing itself is enough to warrant careful attention from people who may be connected to the organisation.

On 22 December 2022, RFF.ORG—Resources for the Future—was listed by the clop ransomware group, which claimed that internal files had been exfiltrated in a ransomware attack. The number of people affected remains unknown, and the precise contents of any taken data have not been publicly confirmed beyond that general description.

What happened

According to available reporting, RFF.ORG was named on the clop ransomware group's leak site on 22 December 2022. The group claimed that internal files were exfiltrated as part of a ransomware attack. No public figure has been given for the volume of data, the number of individuals affected, or the exact method of intrusion. Timing beyond the report date, technical indicators, and any confirmation or denial from the organisation itself are not part of the disclosed record. The listing therefore stands as a claim by the threat actor rather than an independently verified account of every detail.

Who is clop?

Clop is a well-documented ransomware operation that has been active for years and is widely associated with double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if demands are not met. The group has repeatedly used leak sites to name alleged victims and to pressure organisations by advertising stolen material. It has been linked to large-scale campaigns against a range of sectors, often exploiting vulnerabilities in widely used software or gaining access through compromised credentials and then moving laterally to locate valuable files. Public reporting has tied clop to numerous high-profile incidents over time; its pattern is to claim exfiltration and to use the threat of disclosure as leverage. In this case, the group's listing of RFF.ORG should be read as its own claim about the incident, not as independently confirmed proof of every asserted detail.

RFF.ORG and its sector

RFF.ORG is the online presence of Resources for the Future, an independent research organisation focused on environmental, energy, and natural-resource policy—work often summarised by the phrase “Healthy Environment, Thriving Economy.” Organisations of this kind typically conduct economic and policy analysis, convene experts, publish research, and engage with government, academia, foundations, and private-sector partners. They commonly hold internal working documents, correspondence, grant and donor records, personnel information, and research materials that may include unpublished data or stakeholder contacts.

A breach affecting such an institution matters because the data it holds can touch employees, collaborators, funders, and people whose information appears in research or administrative files. Even when the organisation’s public mission is non-commercial, the sensitivity of internal files can still create real exposure for individuals and for the continuity of research and partnerships.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of data types—such as names, contact details, financial records, or specific document categories—has been disclosed, and the number of people affected is unknown. Exact contents therefore remain unconfirmed.

Organisations like Resources for the Future typically maintain a mix of administrative and research-related material. That can include staff and contractor records, email and correspondence, project files, donor or grant documentation, and draft or proprietary research. Whether any of those categories were among the files clop claims to have taken has not been publicly established. Readers should treat the exposure as involving internal files in general, without assuming particular data elements until more is verified.

What's at stake

For individuals, the practical risks depend on what was actually in the taken files. If personal or contact information was included, affected people could face phishing, social-engineering attempts, or unwanted contact that leverages knowledge of their ties to the organisation. If personnel, financial, or identity-related details were present, longer-term concerns such as fraud or account takeover become more relevant. Because the scale and exact data types are undisclosed, the prudent stance is to assume that anyone with a meaningful relationship to RFF—staff, recent partners, or frequent correspondents—may want to monitor for unusual activity.

For the organisation, a claimed exfiltration of internal files raises operational and reputational issues: potential disruption of research work, strain on partner and donor trust, and the cost of investigation and response. None of this establishes negligence as fact; it simply describes the ordinary consequences when a research institution is named in a ransomware leak-site listing.

What to do if you're exposed

If you believe your information may have been connected to RFF.ORG, a few concrete steps reduce risk without requiring you to wait for further official detail:

• Treat unexpected emails, calls, or messages that reference the organisation or your relationship to it with caution; verify through known official channels before responding or clicking links.
• Change passwords on accounts that may have been used in correspondence with RFF, and enable multi-factor authentication where it is available.
• Monitor financial and email accounts for unfamiliar activity and consider a credit freeze or fraud alert if you have reason to think identity data could be involved.
• Keep records of any suspicious contact that appears to use internal knowledge, in case it becomes useful later.
• Run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets.

Public information on this incident remains limited to the December 2022 listing and the claim of internal-file exfiltration. Staying alert to phishing and monitoring your own accounts are still the most practical immediate measures while further confirmation, if any, emerges.

AICompiled with AI assistance from public sources and published under our editorial standards.