AT&S Listed by nokoyawa Ransomware Group

On July 29, 2023, Austrian printed-circuit-board manufacturer AT&S appeared on the leak site of the nokoyawa ransomware group, confirming that internal files had been exfiltrated during a ransomware attack. The listing does not disclose the number of records affected or the precise data types stolen, only that the company’s internal documents may now be in the hands of the extortion actors.

Details from the Leak Site

The primary disclosure on the nokoyawa onion site states that AT&S suffered a ransomware intrusion and that attackers successfully removed internal files before encryption. No sample data is shown publicly, and the listing does not quantify the volume or list specific categories such as customer records, employee personal information, or financial spreadsheets. The notification simply warns that the data will be published unless the company meets the group’s demands. AT&S, incorporated in Singapore in 2009 and active in the oil, gas, and marine sectors, has not released its own public breach notification detailing the incident.

Why This Matters for You and Your Family

When a company like AT&S loses control of internal files, anyone whose personal data ever touched those systems faces heightened risk. Employee records, vendor contracts, and partner contact lists frequently contain names, addresses, dates of birth, Social Security numbers, and email addresses. If your employer, supplier, or service provider does business with AT&S, your information may now sit inside the stolen archive. Even without an exact victim count, the exposure is real: once files leave the corporate network they can be traded, sold, or used to launch follow-on attacks against you and your household.

Doxxing and Identity-Chain Risks

Stolen internal files rarely contain only one data point. A single spreadsheet can link your work email to your personal phone number, home address, and family member names. Attackers then chain these fragments across dozens of other breaches to build a complete profile. The same credentials or personal details exposed here can unlock gaming accounts, social-media profiles, and financial services. Children’s accounts are especially vulnerable because parents often reuse passwords or recovery emails that appear in corporate documents. The result is a widening doxxing chain that can lead to identity theft, targeted phishing, or physical stalking.

Nokoyawa’s Known Track Record

Public reporting attributes the first notable nokoyawa activity to late 2022. The group has since listed manufacturing, technology, and professional-services companies, typically following a double-extortion model: encrypt victim systems and threaten to publish exfiltrated data. Their playbook usually begins with phishing or exploitation of remote-access tools, followed by rapid lateral movement and exfiltration. The group maintains a leak site on the dark web and sets short deadlines for payment. While nokoyawa is smaller than some ransomware brands, its willingness to publish stolen corporate files has been consistent across prior incidents.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used at AT&S or any related vendor anywhere it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts often chained to the same addresses and recovery emails.
• Let remediation specialists handle ongoing takedown requests for any personal records that surface on data-broker or extortion sites.

The AT&S listing is a reminder that corporate breaches continue to feed long-term identity risks for ordinary people. A single exfiltration event can ripple outward for years. Starting now with systematic monitoring and cleanup gives you the best chance of breaking those chains before criminals exploit them. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.