www.shora.ma Listed by tengu Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 20, 2026, the ransomware group tengu listed www.shora.ma on its leak site and claimed to have exfiltrated internal files during a ransomware attack. The number of individuals affected remains unknown, and no further details about the volume or contents of the data have been made public. This listing directly concerns Shora Advisory, a network of accounting, consulting, and auditing firms operating across major Moroccan cities. The incident raises questions about the handling of client records that such firms routinely process.

Inside the incident

The only confirmed information is the February 20, 2026 listing by tengu and the statement that internal files were allegedly exfiltrated. No timeline for the intrusion, no count of records, and no description of the attack method have been disclosed. The organization has not issued a public statement confirming or denying the claims.

Who is tengu?

Tengu is a ransomware group that targets organizations, deploys encryption on their systems, and maintains a public leak site to pressure victims. The group lists entities it claims to have compromised and often threatens to release stolen data. Its listing of www.shora.ma constitutes an unverified claim by the group; independent confirmation of the exfiltration has not been reported.

About www.shora.ma

Shora Advisory operates as a network of accounting, consulting, and auditing firms with offices in major Moroccan cities. Its services include financial management consulting, accounting, legal and tax expertise, and training. The firm emphasizes close client relationships and works with organizations across various industries on matters involving financial records, regulatory compliance, and internal operations.

What was likely exposed

The listing states that internal files were exfiltrated. No specific categories of data—such as client names, financial statements, tax documents, or employee records—have been identified in public reports. Organizations of this type commonly hold client financial information, tax filings, contracts, and correspondence; however, the exact contents of the exfiltrated files remain unconfirmed.

Why it matters

Accounting and advisory firms process detailed financial and legal information that can be used for fraud, identity misuse, or targeted scams if it reaches unauthorized parties. Clients of such firms may face secondary risks if their records were among the files taken. For the organization, the incident adds operational and reputational pressure typical of ransomware listings, regardless of whether a ransom demand was met.

If your data was in this claimed breach

Monitor bank and tax accounts for unusual activity and consider placing fraud alerts with relevant financial institutions. Review any recent correspondence from Shora Advisory for official notifications. Individuals can run a free exposure scan of their email address against known breach data to check for prior appearances of their information in public leaks.

AICompiled with AI assistance from public sources and published under our editorial standards.