CONEX Listed by nokoyawa Ransomware Group

CONEX, a French provider of customs-declaration SaaS software, was listed on the Nokoyawa ransomware group’s leak site on 20 January 2023. The listing states that internal files were exfiltrated during a ransomware attack. The company has not published a public breach notification quantifying the number of records affected or detailing exactly which customer or partner data was taken.

Reported Details from the Leak Site

The Nokoyawa leak page for CONEX, first observed on 20 January 2023, claims the company suffered a ransomware intrusion and that attackers successfully exfiltrated internal files. The listing does not specify the volume of data stolen, the exact file types, or whether customer databases were included. It follows the group’s standard format of posting a sample of allegedly stolen material and threatening full publication unless a ransom is paid. No independent confirmation of the data sample’s authenticity has been released by CONEX, and the notification does not state whether any law-enforcement agencies were contacted.

Why This Matters for You and Your Family

If you or your business have used CONEX’s customs-declaration platform, your information may now sit in an attacker-controlled archive. Even when the leak site does not list specific record counts, the exposure of internal files from a specialised SaaS provider often includes business correspondence, billing records, tax identifiers, and contact details that can be repurposed for identity theft or targeted fraud. For ordinary people whose employers rely on such platforms, this means your personal data may have travelled further than you realise. The breach also highlights how supply-chain vendors in regulated sectors can become gateways that expose individuals who never directly signed up for the service.

Doxxing and Identity-Chain Risks

Customs software providers routinely handle names, addresses, phone numbers, email accounts, VAT identifiers, and sometimes passport or national-ID copies. Once these details appear on a ransomware leak site they can be cross-referenced with other breaches to build complete identity profiles. A single leaked business email can link your work identity to personal accounts, online shopping profiles, and even children’s gaming usernames that share the same recovery phone number or address. These chains accelerate doxxing: attackers or opportunistic criminals can move from one compromised credential to another, hijacking accounts, requesting password resets, or publishing personal information for harassment or extortion. Credential leaks like this one cascade into account takeovers that affect not only corporate systems but household digital lives.

Nokoyawa’s Known Track Record

Public reporting attributes the first significant Nokoyawa campaigns to late 2022. The group has targeted mid-sized organisations across Europe and North America, focusing on sectors with complex compliance needs such as logistics, manufacturing, and specialised software providers. Their typical playbook begins with initial access gained through phishing or exploited remote-desktop services, followed by rapid lateral movement, data exfiltration, and deployment of ransomware. Nokoyawa then uses dual-extortion tactics: threatening both file encryption and public release of stolen documents. The group maintains a leak site that is updated irregularly, sometimes adding victims weeks after initial compromise. While not the largest ransomware operation, Nokoyawa has demonstrated consistency in following through on publication deadlines when ransom demands are ignored.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity so you can see exactly where CONEX-related data may surface.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate any password you used with CONEX or any connected business account, replace it with a unique passphrase, and secure the account with an authenticator app rather than SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses or recovery details exposed in business breaches.
• Let DoxxScan remediation specialists handle takedown requests for any personal records that appear on data-broker or leak sites linked to this incident.

The incident shows that even specialised business software can expose ordinary families when ransomware groups treat stolen files as public bargaining chips. Staying ahead requires more than reactive checks; it demands ongoing visibility into how your information travels across the internet. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks. Source: Nokoyawa leak site listing for CONEX (via ransomware.live).