Ultralife Corporation Listed by avoslocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continued through early 2023 to target mid-sized manufacturers and publicly traded firms, pairing encryption with data theft and public leak-site pressure. In that climate, listings on criminal forums became a common first signal that an organisation’s internal systems had been compromised, often before any formal disclosure.

On 11 February 2023, Ultralife Corporation appeared on a leak site operated by the avoslocker ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and many operational details have not been released. For employees, customers and partners, the listing raises concrete questions about what material left the company’s network and how it might be misused.

What happened

According to public reports dated 11 February 2023, Ultralife Corporation was listed by the avoslocker ransomware group. The available information states that internal files were exfiltrated during a ransomware attack. No confirmed figure has been given for the volume of data taken, the precise date the intrusion began, or the initial access method. The number of individuals affected is recorded as unknown. Beyond the group’s claim on its leak site and the characterisation of the material as internal files, further technical and timeline details remain undisclosed.

The group behind it: avoslocker

Avoslocker is a ransomware operation that emerged in the early 2020s and became known for double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. The group has typically operated a dedicated leak site where it names victims and, in some cases, releases sample files to demonstrate possession of the data. Like other actors in this category, avoslocker has historically focused on organisations that hold commercially sensitive or regulated information, using the prospect of public exposure to increase pressure. Its listing of Ultralife Corporation is a claim by the group; independent confirmation of the full scope of any intrusion has not been supplied in the public record summarised here.

About Ultralife Corporation

Ultralife Corporation is a publicly traded company (NASDAQ: ULBI) headquartered at 2000 Technology Parkway, Newark, New York. It designs and manufactures battery and energy products, power systems and related communications equipment used in defence, medical, industrial and government markets. Organisations of this type routinely maintain engineering and design files, manufacturing data, customer and supplier records, financial and accounting systems, and human-resources information. Because the company serves regulated and high-reliability sectors, a breach that reaches internal repositories can affect not only corporate operations but also contractual and compliance obligations toward clients and partners.

What data was at risk

Public reporting names the exposed material as internal files exfiltrated in a ransomware attack. The same reporting notes that the company’s holdings include client information, design and manufacturing data, financial and accounting records, human-resources material and related business documents. Exact file inventories, record counts and confirmation of which specific categories were taken have not been disclosed. In the absence of a detailed inventory, it is not possible to state with certainty which individual records left the environment; only that internal files were claimed to have been removed.

The real-world impact

For people whose information may have been among the internal files, practical risks include targeted phishing, social-engineering attempts that reference real internal details, and longer-term misuse of personal or employment data if HR material was involved. Customers and partners face the possibility that commercial, design or contractual information could be exposed or sold, creating competitive or operational friction. For Ultralife itself, consequences can include investigative and recovery costs, notification and regulatory obligations where personal data is confirmed to be involved, and reputational strain with investors and clients. Because the scale of the exfiltration and the precise data types remain unconfirmed in public sources, the full extent of harm cannot yet be measured; the prudent assumption is that any sensitive internal material that left the network retains value to criminals for as long as it circulates.

Were you affected?

If you are a current or former employee, customer, supplier or partner of Ultralife Corporation, treat the incident as a prompt to review your own exposure rather than as proof that your specific records were taken. Practical first steps include:

• Monitor financial and credit activity for unexpected accounts or inquiries.
• Be alert to phishing or phone contacts that reference Ultralife projects, invoices or internal names.
• Change passwords on any accounts that reused credentials potentially stored in corporate systems, and enable multi-factor authentication where available.
• Retain any official notices the company may issue and follow the channels they designate for questions.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That check will not confirm or rule out involvement in this specific incident, but it can show whether your address is circulating more widely and help you prioritise further protections.

AICompiled with AI assistance from public sources and published under our editorial standards.