RODS Surveying (rods.cc) Listed by fog Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a surveying firm appears on a ransomware group's leak site, the immediate concern is not abstract cybersecurity jargon but the concrete possibility that project files, client records or internal correspondence have left the organisation's control. For anyone who has worked with RODS Surveying, shared site plans, or simply appears in its systems, the listing raises a practical question: has personal or commercial information been copied and could it now be used for fraud, competitive harm or further intrusion?

Public reporting on 23 December 2024 stated that the ransomware group known as fog had listed RODS Surveying (rods.cc) and claimed to have taken 43.5 GB of internal files. The number of people affected remains unknown, and independent confirmation of the full scope is limited. What follows is a careful account of what is known, what is claimed, and what the episode means for those who may be involved.

What happened

According to the available record, RODS Surveying was listed by the fog ransomware group on or around 23 December 2024. The group asserted that it had conducted a ransomware attack in which internal files were exfiltrated, with the volume of data described as 43.5 GB. No further technical details—such as the initial access method, the precise date of intrusion, or whether systems were encrypted—have been publicly disclosed in the source material. The number of individuals whose information may have been involved is listed as unknown. The listing itself constitutes a claim by the group; it has not been independently verified in the facts provided, and the organisation has not issued a detailed public statement within the material available here.

In short, the incident is characterised as a ransomware event involving data theft, with fog presenting the victim on its leak site and citing a specific data volume. Beyond those points, public detail is limited.

Inside fog

Fog is a ransomware operation that has been active in the public domain since early 2024. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems to disrupt operations while simultaneously copying data and threatening to publish or sell it if a ransom is not paid. Victims are commonly listed on a dedicated leak site, often with sample files or volume claims intended to increase pressure. Fog has been observed targeting organisations across multiple sectors rather than specialising in a single industry, and its operators have shown a preference for relatively rapid listing of new victims once data is claimed to be in hand.

Public reporting on fog has noted the use of common initial-access techniques seen across the ransomware ecosystem—such as exploitation of exposed remote-access services or compromised credentials—though the precise vector used against any given organisation is rarely confirmed by the group itself. The group’s leak-site posts function as both a pressure tactic and a form of advertising; they should be treated as assertions rather than verified forensic findings. In the present case, fog’s listing of RODS Surveying and the accompanying 43.5 GB figure are therefore recorded as claims made by the group.

RODS Surveying (rods.cc) and its sector

RODS Surveying operates under the domain rods.cc and belongs to the land-surveying and geospatial services sector. Firms of this type produce and manage cadastral surveys, topographic maps, construction layout data, boundary determinations and related technical documentation. Their work routinely intersects with property owners, developers, local authorities, engineering consultancies and construction contractors. As a result, such organisations typically hold a mixture of commercial project files, client contact details, site photographs, coordinate data, contracts and internal correspondence.

A breach at a surveying practice is consequential because the data often combines commercially sensitive design information with personal identifiers of clients and staff. Even when the material is technical rather than purely personal, its unauthorised release can affect property transactions, competitive bidding, regulatory compliance and the privacy of individuals whose names or addresses appear in project records. The sector’s reliance on digital file exchange and remote collaboration further means that a single compromise can touch multiple external parties who never directly interacted with the firm’s IT systems.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack and that the volume claimed is 43.5 GB. No more granular inventory—such as specific file types, databases or categories of personal data—has been disclosed. Organisations in the surveying sector commonly retain client names and contact information, project briefs, survey drawings, geospatial datasets, invoices, employee records and correspondence with third parties. Whether any or all of these categories were present in the 43.5 GB claimed by fog remains unconfirmed.

Because the exact contents have not been independently detailed, it is not possible to state with certainty which individuals or which classes of information were affected. The only firm public description is that internal files were taken; everything beyond that is either typical of the sector or asserted by the threat actor without corroboration in the available record.

Why it matters

For people whose details may have been among the internal files, the practical risks include targeted phishing that references genuine project names, identity-related fraud if personal identifiers were present, and the possibility that commercial documents could be used by competitors or other unauthorised parties. Even technical survey data can reveal property boundaries, development plans or infrastructure details that owners would prefer to keep private. The unknown number of affected individuals means that anyone who has recently commissioned work from, or been employed by, RODS Surveying has reason to treat the incident as potentially relevant until more information emerges.

For the organisation itself, the episode carries operational, reputational and regulatory consequences. Ransomware incidents frequently disrupt day-to-day work, require forensic investigation and may trigger notification duties under data-protection law if personal data prove to have been involved. The public listing by a ransomware group also places the firm under external scrutiny regardless of whether a ransom is paid or data is ultimately released. None of these outcomes imply negligence as an established fact; they simply describe the ordinary downstream effects of a claimed data-exfiltration event.

Were you affected?

If you have been a client, employee or business partner of RODS Surveying, treat the possibility of exposure as real until clearer information is available. Monitor financial and email accounts for unusual activity, be cautious of unsolicited messages that reference surveying projects or property details, and consider placing fraud alerts with relevant credit or identity-protection services if you believe personal identifiers may have been involved. Because the precise contents of the claimed 43.5 GB remain undisclosed, these steps are precautionary rather than evidence of confirmed compromise.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach datasets. Such a scan will not prove or disprove involvement in this specific incident, but it can indicate whether the same address has surfaced elsewhere and may help prioritise further protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.