Yource Bulgaria & Greece Listed by crypto24 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Yource Bulgaria & Greece was listed by the crypto24 ransomware group on December 30, 2025, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may have been affected; anyone connected to the organisation should check for any notifications or unusual activity and take protective steps.
What happened
The listing indicates that a ransomware attack resulted in the exfiltration of internal files from Yource Bulgaria & Greece. No information has been released on the date of the intrusion, the number of records involved, or the precise method used to gain access. The scale of impact on individuals remains unknown.
The group behind it: crypto24
Crypto24 is a ransomware group that publishes victim names on a dedicated leak site after encrypting systems and removing data. Its pattern of activity includes targeting mid-sized and regional organisations that hold client or operational records, followed by selective disclosure of file categories to increase pressure on the affected entity. The group’s listing of Yource Bulgaria & Greece constitutes its own claim; independent confirmation of the data’s authenticity or volume has not been provided.
About Yource Bulgaria & Greece
Yource Bulgaria & Greece operates as a customer-experience and contact-centre services provider with facilities in both countries. Such organisations routinely process personal and account information on behalf of corporate clients across multiple sectors. A compromise at this type of intermediary can therefore affect both the provider’s own staff records and data belonging to its clients’ end users.
What was likely exposed
The group claims to possess internal files that include HR, customer, financial and project-related information, together with customer datasets linked to client engagements. The exact contents and completeness of any such material have not been verified by the organisation or by independent parties.
- HR records
- Customer information
- Financial documents
- Project files
- Client-associated datasets (Eneco Belgium, bofrost, essent.be, Media Compentence, Sodexo, Spotzer)
Why it matters
Individuals whose records appear in HR or customer files may face risks of identity misuse or targeted fraud if the material circulates. Client organisations listed in the claim could encounter secondary regulatory or contractual questions. For the provider itself, the incident adds to the operational and reputational consequences already associated with ransomware activity.
Were you affected?
Begin by reviewing any direct notifications from Yource Bulgaria & Greece or its clients. Change passwords for accounts that may be linked to the organisation and enable multi-factor authentication where available. Readers can also run a free exposure scan of their email address against known breach data to determine whether their information has appeared in previously published sets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
SOUBEIRAN CHOBET S.R.L. Listed by crypto24 Ransomware GroupMochtar Karuwin Komar: Indonesian law firm - MKK Listed by crypto24 Ransomware GroupInternational Busines Service Listed by crypto24 Ransomware GroupEstudio O'Farrell Listed by crypto24 Ransomware GroupLatest breaches
Publicly posted by crypto24 — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.