SOGO Auction Listed by ransomexx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose information appears in SOGO Auction records now face the possibility that internal documents have been copied and placed on a public leak site. The scale of any personal exposure remains unknown because the number of affected individuals has not been reported. SOGO Auction was listed by the ransomware group ransomexx on 17 April 2026. The listing states that 951 MB of internal files were taken during a ransomware attack. No further details on the timing of the intrusion, the method of entry, or confirmation of the data release have been made public.

What happened

The incident is known only through the group’s public listing of SOGO Auction as a victim. The listing claims that 951 MB of internal files were exfiltrated. No independent confirmation of the volume, the contents, or the date of the theft has been released. The number of individuals whose data may be involved is also undisclosed.

The group behind it: ransomexx

Ransomexx is a ransomware operation that has been publicly tracked for several years. The group typically gains access to corporate networks, deploys encryption, and removes copies of files before demanding payment. When an organisation does not pay, the group has placed stolen material on its leak site. The listing of SOGO Auction follows this pattern, but the claim that data was taken from this specific victim rests solely on the group’s statement.

Who is SOGO Auction?

SOGO Auction is a Japan-based firm that has conducted auctions of used construction machinery and heavy equipment since the 1990s. It runs both physical and online sales of items such as excavators and bulldozers and is operated by SOGO Corporation. Organisations in this sector routinely collect records on bidders, sellers, equipment provenance, financial transactions, and site operations.

What data was at risk

The only detail released is that internal files were taken. The exact categories of information inside those files have not been published. Typical records held by an auction house of this type include client contact details, bidding histories, payment information, and equipment documentation, but whether any of these categories are present in the exfiltrated material remains unconfirmed.

Why it matters

Exposure of internal files can reveal operational practices, supplier relationships, and customer identifiers that are not normally public. Individuals named in such records may later receive unsolicited contact or see their details appear in other data sets. For the organisation, the release adds pressure during any recovery process and may affect future business relationships that rely on confidentiality.

What to do if you're exposed

Anyone who has taken part in SOGO Auction sales or who uses an email address associated with the company can check whether their address appears in known public breach data.

• Review bank and auction account statements for unusual activity.
• Enable multi-factor authentication on any accounts linked to the same email or phone number.
• Run a free exposure scan of the email address through a reputable breach-checking service.
• Keep records of any unexpected contact that references the auction house.

AICompiled with AI assistance from public sources and published under our editorial standards.