US Claims Solutions Listed by knight Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 1, 2023, the ransomware group known as knight listed US Claims Solutions on its leak site, claiming responsibility for a ransomware attack in which internal files were exfiltrated. The group asserted that more than 600GB of sensitive data had been stolen. The number of people affected remains unknown, and independent confirmation of the full scope has not been publicly detailed beyond the listing itself.

The incident matters because organisations that handle claims routinely process personal, financial, and case-related information. When a group claims to have taken a large volume of internal files, those whose data may have been held by the company face potential exposure even if exact contents and victim counts are still unconfirmed.

What happened

Public reporting states that US Claims Solutions was listed by the knight ransomware group on November 1, 2023. According to the group's own leak-site material, the attack involved ransomware and the exfiltration of internal files. The group claimed that over 600GB of sensitive data were stolen and referenced related entities including Mankin Custom Motors, LLC and FF&O, described as a subsidiary of The FF&O Group, along with associated websites. The listing also included fragmentary contact and organisational references. No further verified details on the intrusion method, exact timeline of compromise, or independent forensic confirmation have been disclosed in the available record. The scale of individuals affected is listed as unknown.

Who is knight?

Knight is a ransomware group that has operated in the public threat landscape by conducting double-extortion style attacks: encrypting systems while also claiming to steal data and threatening to publish it on a dedicated leak site if demands are not met. Like other groups in this category, knight typically posts victim names, sample file listings or volume claims, and countdown-style pressure tactics to increase leverage. Its listings are claims made by the actors themselves and are not independently verified at the moment of posting. Prior public activity associated with the name has followed the familiar pattern of targeting organisations across multiple sectors, exfiltrating data, and using leak sites for publication threats. Nothing in the available facts confirms specific additional statements knight made solely about US Claims Solutions beyond the volume claim, the description of internal files, and the organisational references included in the listing.

US Claims Solutions and its sector

US Claims Solutions operates in the claims-handling sector, a field that supports the processing, administration, and resolution of insurance or related claims on behalf of clients or partners. Companies in this space commonly sit between insurers, policyholders, and service providers; they therefore routinely receive and store personal identifiers, claim documentation, correspondence, and financial or settlement-related records. The group's listing also referenced affiliated or related names such as Mankin Custom Motors, LLC and entities under The FF&O Group, indicating a broader organisational footprint that may share systems or data flows. A breach affecting a claims-solutions provider is consequential because the data such firms hold is often detailed, time-sensitive, and linked to real financial and personal circumstances of individuals and businesses. Even when the precise contents of a theft remain unconfirmed, the sector's typical data holdings make any large-scale exfiltration claim material to those whose information may have been processed.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack and that the group claimed more than 600GB of sensitive data were stolen. No itemised inventory of data types—such as names, addresses, Social Security numbers, claim files, financial account details, or medical information—has been independently confirmed in the public record. Organisations of this kind typically hold claim-related documents, personal contact and identity data, correspondence, and payment or settlement records. Because the exact contents remain unconfirmed beyond the group's characterisation of “sensitive data” and “internal files,” it is not possible to state with certainty which specific categories were included in the claimed 600GB. Readers should treat the volume and sensitivity assertions as actor claims until corroborated.

What's at stake

For individuals whose information may have been held by US Claims Solutions or related entities, the practical risks include potential misuse of personal details for fraud, targeted phishing that references real claim or account information, and longer-term identity or financial harm if identifiers or documents were among the files taken. Because the number of people affected is unknown and the precise data types are unconfirmed, the exposure level for any single person cannot yet be quantified. For the organisation, a public ransomware listing can bring operational disruption, regulatory and contractual scrutiny, reputational damage, and the costs of investigation, notification, and remediation. The combination of a large claimed data volume and the sensitive nature of claims work elevates the stakes even while key details remain limited.

If your data was in this claimed breach

If you have done business with US Claims Solutions or related entities named in connection with the listing, treat the possibility of exposure seriously until more definitive information appears. Monitor financial and insurance accounts for unexpected activity, place fraud alerts or credit freezes if you are concerned about identity theft, and be alert to phishing attempts that reference claims, settlements, or personal details you may have shared. Change passwords on related accounts and enable multi-factor authentication where available. Keep records of any official notifications you receive from the company. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets, which can help you prioritise further protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.