On April 09, 2023, German company ISONA GmbH appeared on the leak site operated by the malas ransomware group. The listing states that internal files were exfiltrated during a ransomware attack that leveraged a Zimbra vulnerability. The entry does not disclose the number of people affected, the exact volume or types of files taken, or any ransom demand.
Watch ISONA GmbH
Get alerted the next time ISONA GmbH files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about ISONA GmbH’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details from the Leak Site
The primary disclosure on the malas leak site lists ISONA GmbH as a victim and claims the company failed to meet the group’s demands. It explicitly attributes initial access to a Zimbra vulnerability and confirms that internal files were successfully exfiltrated. No sample data is shown in the public listing, and the exact content of the stolen material remains unknown to outsiders. The disclosure follows the group’s standard format for companies it labels “defaulters,” indicating the negotiation window has closed.
Why This Matters for You and Your Family
When a company that holds personal data suffers a ransomware breach, the information it stores about customers, employees, vendors, or partners can end up in criminal hands. Even though the malas listing does not quantify affected records, any exposed internal files could contain names, addresses, dates of birth, financial details, or correspondence that criminals later use for identity theft or targeted fraud. For ordinary families this translates into months or years of heightened risk because stolen corporate data tends to circulate quietly among multiple threat actors long after the initial leak.
Doxxing and Identity-Chain Risks
Ransomware operators rarely stop at encrypting systems; they exfiltrate data precisely because it can be monetized through extortion or sold on. Once internal files leave the victim’s network they can link email addresses, employee names, customer records, and internal usernames to real-world identities. These fragments become the starting point for doxxing chains that reveal home addresses, phone numbers, family relationships, and even children’s online accounts. Credential leaks from such incidents frequently cascade into gaming-platform takeovers, where a child’s username and reused password grant attackers entry to Discord, Steam, or Roblox profiles that further expose household information.