V-ON Listed by mosesstaff Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 18, 2021, the organization V-ON appeared on a leak site operated by the ransomware group mosesstaff. The listing indicates that internal files were taken during a ransomware operation, though the number of people affected and the full scope of any data exposure have not been confirmed publicly. The incident is known only through the group’s site. No independent verification of the claimed theft or details on how the files were obtained has been released. The reported summary states that mosesstaff listed V-ON and asserted possession of internal data, without further specifics on volume, file types, or whether the data was later published.

Breaking down the breach

The only confirmed public record is the December 18, 2021 listing on the mosesstaff leak site. The group claims to have stolen internal data from V-ON, described as files exfiltrated during a ransomware attack. No information has been made available on the timing of the intrusion itself, the method used to gain access, or the quantity of material involved. The number of individuals whose information may be present in the files remains unknown.

Who is mosesstaff?

Mosesstaff is a ransomware operation that maintains a public leak site to list organizations it claims to have targeted. The group’s documented pattern involves encrypting systems and then posting samples or directories of stolen files to increase pressure on victims. Prior activity attributed to the group has included claims against entities in multiple countries and sectors, with the same tactic of using a leak site to publicize alleged thefts when ransom demands are not met.

Who is V-ON?

Public detail on V-ON is limited. The organization maintains internal files that would typically include operational records, communications, and administrative documents. Entities that hold such material are responsible for protecting it under applicable data-protection rules, and any confirmed exposure can trigger regulatory review and notification obligations.

The information in question

The listing refers only to “internal files” and “internal data.” No inventory of specific data categories has been published. Organizations of this type commonly store employee records, business correspondence, financial documents, and system credentials; however, the exact contents of the material claimed by mosesstaff have not been verified or disclosed.

Why it matters

Exposure of internal files can reveal sensitive operational details that affect both the organization and any individuals referenced in those records. For the organization, the incident may lead to regulatory scrutiny and costs associated with investigation and remediation. For individuals, the primary concerns are potential misuse of any personal information that happens to be present and the possibility that credentials or other identifiers could be used in further attacks.

If your data was in this claimed breach

Monitor accounts for unusual activity and change passwords for any services where the same credentials may have been reused. Enable multi-factor authentication wherever possible. Organizations are expected to notify affected individuals if personal data has been confirmed as exposed; until such notice is received, individuals can check whether their email address appears in known breach data through a free exposure scan offered by services that aggregate public breach records.

AICompiled with AI assistance from public sources and published under our editorial standards.