Squeezer-software Listed by fog Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to dominate the cyber-threat landscape in 2025, routinely combining encryption with data theft and public leak-site postings to pressure victims. Listings appear with little warning, often naming organisations whose internal systems have been accessed, and the volume of such claims keeps rising even as defenders improve detection. Against that backdrop, the appearance of Squeezer-software on a fog ransomware group leak site on 12 February 2025 is a typical, if still concerning, development that warrants careful scrutiny rather than alarm.

Public detail remains limited: the group claims to have exfiltrated internal files during a ransomware attack, yet the number of people affected is unknown and no further technical confirmation has been released. For anyone who has dealt with Squeezer-software, the listing is a reminder that software firms hold sensitive operational material whose exposure can create lasting risk.

What happened

On 12 February 2025, Squeezer-software was listed by the fog ransomware group. The only concrete detail supplied is that internal files were allegedly exfiltrated in a ransomware attack. No statement has confirmed the precise date of intrusion, the scale of systems affected, the encryption status of any data, or the method of initial access. An extract associated with the listing also names INGV and Spacemanic alongside Squeezer-software, but the relationship among these entities and the incident itself is not explained. The number of people affected remains unknown, and no independent verification of the group’s claims has been published.

Who is fog?

Fog is a ransomware operation that became active in the mid-2020s and follows the now-standard double-extortion model: data is stolen before systems are encrypted, and the threat of public release is used to compel payment. The group maintains a leak site on which it posts victim names, sample files and, in some cases, full archives once deadlines pass. Its targets have spanned manufacturing, professional services, technology and public-sector organisations across multiple continents. Fog typically gains entry through compromised credentials, unpatched remote-access services or phishing, then moves laterally to locate high-value repositories. Because the group’s listings are self-reported, each claim—including the one involving Squeezer-software—must be treated as unverified until corroborated by the victim or forensic evidence.

Squeezer-software and its sector

Squeezer-software is a software-development organisation. Companies of this type routinely maintain source-code repositories, internal project documentation, customer configuration data, employee records and intellectual-property assets. In the broader technology sector such material is commercially sensitive and, when customer or partner information is involved, can also contain personal data. A ransomware incident at a software firm therefore raises two distinct concerns: disruption of development and support operations, and the potential leakage of code or documentation that competitors or other threat actors could exploit. The February 2025 listing places Squeezer-software among a growing number of technology providers that have appeared on ransomware leak sites, underscoring the sector’s attractiveness to groups seeking both operational leverage and resale value of stolen material.

What data was at risk

The only data type named in connection with the incident is “internal files” said to have been exfiltrated. No inventory of file names, volumes, or categories has been released, and the number of individuals whose information may be present is unknown. Organisations that develop software commonly store source code, build scripts, internal wikis, contracts, employee directories and customer support tickets. Any of these could fall under the broad heading of internal files, yet their actual presence in the stolen set remains unconfirmed. Until Squeezer-software or independent investigators publish a verified list, the precise contents of the exfiltrated material cannot be stated as fact.

Why it matters

For individuals whose contact details, project records or credentials may reside among the internal files, the practical risks include targeted phishing, credential stuffing and social-engineering attempts that reference genuine internal information. For the organisation itself, the exposure of proprietary code or process documentation can erode competitive advantage and complicate regulatory or contractual obligations. Even when the full scope stays undisclosed, the mere public claim of a ransomware attack can damage trust among customers and partners who rely on the firm’s security posture. Because the number of people affected is unknown, the potential impact cannot yet be quantified, but the combination of data theft and ransomware remains one of the more disruptive patterns currently observed.

What to do if you're exposed

Anyone who has done business with Squeezer-software or whose email address appears in its systems should treat the listing as a prompt for basic hygiene rather than proof of personal compromise. Change passwords that may have been reused, enable multi-factor authentication wherever possible, and monitor financial and email accounts for unusual activity. Be sceptical of unsolicited messages that reference internal projects or claim to come from the company. As a further check, readers can run a free exposure scan of their email address to see whether it has already appeared in known breach data sets. If the scan returns a hit, follow the recommended steps for that specific exposure; if it returns nothing, continue ordinary vigilance while awaiting any official notification from Squeezer-software.

AICompiled with AI assistance from public sources and published under our editorial standards.