Thors-Data.dk Listed by redransomware Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized organisations across Europe, using double-extortion tactics that combine encryption with data theft and public listing on leak sites. In this environment, even limited public disclosures can signal real risk for employees, partners and customers whose information may have been taken.

On 5 March 2024, the Danish firm Thors-Data.dk appeared on a listing published by the ransomware group redransomware. Public detail remains sparse: the group claims to have exfiltrated internal files during a ransomware attack, the number of people affected is unknown, and no further technical or volume figures have been released. The listing itself is an unverified claim by the actors; independent confirmation of the full scope has not been made public.

Inside the incident

According to the available record, Thors-Data.dk was listed by redransomware on 5 March 2024. The only concrete description provided is that internal files were allegedly exfiltrated in a ransomware attack. No information has been released about the initial access method, the duration of any intrusion, the volume of data taken, or whether systems were encrypted. The number of individuals potentially affected is listed as unknown. Because the primary source is the group’s own leak-site claim, the precise sequence of events and the completeness of the theft remain unconfirmed by independent reporting.

The group behind it: redransomware

Redransomware is a ransomware operation that follows the now-common double-extortion model: after gaining access, operators encrypt systems and simultaneously steal data, then threaten to publish the material if a ransom is not paid. Like other groups of this type, they maintain a public leak site where they post victim names and, in some cases, sample files to pressure organisations. Public reporting on the group has documented a pattern of targeting small-to-medium enterprises across multiple sectors, often with relatively short dwell times before encryption. They typically demand payment in cryptocurrency and set short deadlines before releasing stolen data. No specific statements by redransomware about the content or volume of data allegedly taken from Thors-Data.dk have been independently verified beyond the basic claim of internal-file exfiltration.

Thors-Data.dk and its sector

Thors-Data.dk operates in the holding-companies and conglomerates sector. Organisations of this kind typically sit at the centre of corporate groups, overseeing subsidiaries, managing shared services, and holding financial, contractual and operational records that span multiple entities. In Denmark and the wider Nordic region, such firms often maintain sensitive commercial information, employee records, board-level documents and data relating to investments or acquisitions. A breach at a holding company can therefore affect not only the parent entity but also the network of companies and individuals connected to it. The public listing places Thors-Data.dk in a category of organisations whose compromise can have cascading consequences for business partners and staff.

What was likely exposed

The only data type named in the public record is “internal files exfiltrated in a ransomware attack.” No inventory of file types, no count of documents, and no confirmation of personal data categories have been released. Holding companies and conglomerates commonly store financial statements, contracts, employee and contractor details, correspondence, and strategic planning materials. Whether any of those categories were among the files allegedly taken from Thors-Data.dk is unconfirmed. Until more detailed disclosure appears, the exact contents of the exfiltrated material remain unknown.

Why it matters

For individuals whose information may have been among the internal files, the practical risks include identity fraud, targeted phishing, and unsolicited contact that leverages knowledge of their employment or business relationships. Even when personal data is not the primary target, internal documents can contain names, email addresses, phone numbers and organisational charts that enable social-engineering attacks. For the organisation itself, the listing creates reputational pressure, potential regulatory scrutiny under European data-protection rules, and the operational cost of investigating and containing the incident. Because the number of people affected is unknown, the full human impact cannot yet be quantified; the absence of that figure itself underscores the need for caution among anyone connected to the firm.

What to do if you're exposed

If you have a past or present connection to Thors-Data.dk—as an employee, contractor, partner or customer—treat the possibility of exposure seriously even though details remain limited. Monitor bank and credit accounts for unusual activity, enable multi-factor authentication on email and financial services, and be alert to phishing messages that reference the company or its subsidiaries. Change passwords that may have been reused across work and personal accounts. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach datasets; such a check provides an early indication of whether further protective steps are warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.