SUBCARN WAS HACKED AND OVER 200 GB OF SENSETIVE DATA WAS STOLEN Listed by lv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups have continued to pressure organisations by pairing encryption with the threat of public data leaks, turning stolen files into leverage long after an initial intrusion. Listings on criminal leak sites have become a routine feature of that landscape, often appearing before victims or independent investigators can fully confirm what happened.

On 2 November 2022, the organisation SUBCARN appeared on a leak site operated by the group known as lv. The listing claimed that SUBCARN had been hacked and that more than 200 GB of sensitive data had been stolen. Public reporting on the incident is limited to that claim and to the description of internal files exfiltrated in a ransomware attack; the number of people affected remains unknown.

Inside the incident

According to the available record, SUBCARN was listed on the lv ransomware leak site with the assertion that the organisation had been compromised and that over 200 GB of sensitive data had been taken. The group claims to have stolen internal data. The reported summary characterises the material as internal files exfiltrated in a ransomware attack.

Beyond that listing and the stated volume, public detail is sparse. The precise timing of any intrusion, the initial access method, whether systems were encrypted, whether a ransom demand was made or paid, and whether any data was later published in full are not disclosed in the facts available. The number of individuals whose information may have been involved is unknown. What is established in the public summary is the leak-site claim itself and the characterisation of the material as internal files taken during a ransomware-related incident.

Inside lv

lv is known publicly as a ransomware operation that has used double-extortion tactics: encrypting victim systems while also copying data and threatening to release it if demands are not met. Like other groups in this category, lv has maintained a leak site where it names organisations and, in some cases, posts samples or larger archives to increase pressure. Such listings are claims by the actors; they are not independent confirmation of every detail asserted.

Public reporting on lv over time has described typical ransomware patterns—intrusion, lateral movement, data theft, and extortion—rather than a single unique technique reserved for one victim. For this incident, the facts support only that SUBCARN was named on the lv leak site and that the group claims to have stolen internal data amounting to more than 200 GB. No further statements attributed to lv about SUBCARN specifically are included in the record provided here.

Who is SUBCARN?

Public detail identifying SUBCARN’s exact business lines, size, or geography is limited in the material at hand. In general terms, organisations that appear in ransomware leak listings are typically companies or institutions that hold internal operational documents, employee or customer records, contracts, and other business files as a normal part of running their operations. A breach affecting such an entity matters because internal files can include information about staff, partners, clients, or proprietary processes, and because the mere listing can create uncertainty for anyone who has dealt with the organisation.

Without fuller public background on SUBCARN itself, the consequential aspect of the incident rests on the nature of the claim: a ransomware group asserting theft of a substantial volume of internal material, with the possibility that some of that material could relate to real people or ongoing business relationships.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. The leak-site headline associated with the listing refers to more than 200 GB of sensitive data. No further breakdown—such as specific categories like financial records, identity documents, medical data, or credentials—is provided in the available record.

Organisations of many kinds commonly hold employee information, correspondence, contracts, financial and operational documents, and sometimes customer or partner data. Whether any of those categories were present in the files lv claims to have taken from SUBCARN is unconfirmed. Exact contents remain undisclosed beyond the description of internal files and the claimed volume.

The real-world impact

When internal files are stolen in a ransomware incident, the practical risks depend on what those files actually contain. If personal data is present, affected individuals may face phishing, social engineering, or fraud attempts that misuse details about their work, accounts, or relationships. If commercial or operational documents are involved, the organisation may face competitive harm, contractual complications, or regulatory scrutiny, depending on jurisdiction and the nature of the data.

Because the number of people affected is unknown and the precise data types are not itemised beyond “internal files,” the scale of individual harm cannot be stated as fact. The organisational impact includes the cost and disruption of incident response, potential legal and notification obligations, and the reputational effect of a public leak-site listing—regardless of whether every claim on that listing is later verified. Uncertainty itself is a form of harm: people connected to SUBCARN may not know whether their information was included.

If your data was in this claimed breach

If you have a past or current relationship with SUBCARN—as an employee, customer, partner, or contractor—treat the incident as a reason for heightened caution rather than proof that your personal data was definitely taken. Monitor financial and email accounts for unexpected activity, be wary of unsolicited messages that reference the organisation or that pressure you to act quickly, and consider updating passwords on important accounts, especially if you reused credentials. Enable multi-factor authentication where it is available.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach datasets. That step does not confirm or deny inclusion in this specific incident, but it can help you see whether your address appears in other circulated collections and prioritise further protections accordingly.

AICompiled with AI assistance from public sources and published under our editorial standards.