On September 02, 2023, Canadian IT services provider DOIT appeared on the leak site operated by the RagnarLocker ransomware group. The listing states that the company suffered a ransomware attack in which internal files were exfiltrated, and the attackers claim the data includes information belonging to DOIT’s own clients. The exact number of records exposed remains unknown, as neither the leak-site posting nor any subsequent company notification has quantified the breach.
Watch Doit
Get alerted the next time Doit files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Doit’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Primary Disclosure Details
The RagnarLocker leak site lists DOIT as a victim and asserts that internal company files were stolen during the ransomware intrusion. The posting does not specify the volume or precise categories of data taken, only that the material is “internal” and relates to the firm’s client base. No ransom demand figure or payment deadline is publicly detailed on the site. The disclosure channel is the ransomware group’s own leak portal, accessed via the .onion link indexed by ransomware.live. Public reporting on RagnarLocker indicates the group typically posts compressed archives or file trees as proof of compromise once negotiations stall.
Why This Matters for You and Your Family
If you or any member of your family has been a client of DOIT, your information may now sit in an attacker-controlled archive. Internal files from an IT services provider frequently contain contracts, invoices, network diagrams, credentials, or contact details that can be repurposed for identity theft, business email compromise, or targeted phishing. Even when record counts are not published, the exposure of client data from a managed service provider creates downstream risk: one leaked email or phone number can serve as the starting point for attackers to map your digital footprint. For ordinary households this translates into higher odds of receiving convincing fraud calls, SIM-swapping attempts, or ransomware demands aimed at you personally.
Doxxing and Identity-Chain Implications
Ransomware leaks rarely stop at the initial victim. Once internal files leave the victim’s network they often circulate in underground forums where other criminals search for personally identifiable information, corporate credentials, or relationships that can be chained together. A single exposed client invoice might link your home address, email, and phone number to your employer or business partners. Those details then feed automated doxxing tools that correlate gaming usernames, social-media handles, and family member names. The result is an identity chain that can lead to account takeovers on personal services, including children’s gaming accounts that reuse the same password or recovery email. When such chains are built, harassment, extortion, or financial fraud can follow months after the original breach drops.