COREBI(NowVertical) Listed by arcusmedia Ransomware Group

On July 14, 2026, NowVertical (operating as COREBI) appeared on the leak site of the arcusmedia ransomware group with an extortion deadline of July 21, 2026. The listing states that internal files were exfiltrated during a ransomware attack on the global data and AI company. The leak-site posting does not specify the volume or exact categories of data taken, nor does it list individual victims, leaving affected customers and partners uncertain about their personal exposure.

Confirmed Details from the Listing

The arcusmedia leak site, mirrored on ransomware.live, explicitly names NowVertical and claims successful data exfiltration following a ransomware deployment. The disclosure indicates that the company’s internal files were taken and will be published if the victim does not meet the group’s demands by the stated deadline. No sample data has been released publicly at the time of the listing, and the notification does not quantify how many customer records or employee records may be involved. Public reporting on arcusmedia’s prior postings shows the group typically posts proof-of-compromise screenshots or file-tree listings before escalating to full data dumps.

Why This Matters for You and Your Family

When a data and AI company like NowVertical is breached, the information it holds often includes details supplied by customers, partners, and vendors. Even though the exact data types remain undisclosed, internal files from such organizations frequently contain contracts, contact databases, financial records, or processed customer datasets. If your personal or family information was ever shared with NowVertical or one of its clients, those details could now sit in an attacker’s archive. The uncertainty itself creates risk: you cannot easily assess exposure without knowing what was taken, which is why proactive checks are essential for ordinary people whose data travels through multiple vendors.

Credential material or contact information exposed in these incidents routinely surfaces in subsequent fraud attempts, phishing campaigns, or identity-theft schemes targeting households.

Doxxing and Identity-Chain Risks

Ransomware leaks like this one rarely stop at the corporate victim. Exfiltrated internal files often contain spreadsheets that link names, email addresses, phone numbers, and sometimes partner or customer identifiers. Attackers and opportunistic criminals then chain these fragments with data from other breaches to build complete identity profiles. A single leaked work email can lead to personal accounts, home addresses, and family member details. For households this means children’s gaming accounts, shared family calendars, or parental credit profiles can become linked targets once the initial corporate data appears on dark-web markets. The speed at which such chains form has shortened dramatically; material posted on July 14 could be repackaged and sold within days.

Arcusmedia’s Known Track Record

Public reporting attributes arcusmedia with emerging in late 2024 as a ransomware-as-a-service operator that focuses on mid-sized technology and data-handling firms. The group’s typical playbook begins with initial access gained through compromised remote desktop credentials or phishing, followed by rapid lateral movement, data exfiltration, and then deployment of ransomware. After encryption, arcusmedia pressures victims with a short negotiation window before publishing samples on its leak site. Notable prior victims have included logistics providers and software vendors, though exact details vary across underground forums. The group’s extortion style combines financial demands with threats of full data publication and, in some cases, direct contact with the victim’s customers. The July 14 listing against NowVertical fits this established pattern.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including no-subscription cleanup of exposed records.
• Rotate any password you have reused at NowVertical or related services and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to credential-stuffing attacks that cascade from corporate leaks.
• Let remediation specialists handle data-broker takedown requests and follow-up monitoring on your behalf while you focus on securing day-to-day accounts.

The NowVertical incident underscores that corporate ransomware attacks increasingly translate into personal exposure for ordinary customers and employees. A single listing can ignite months of downstream risk if identity chains are not mapped and broken early. Start your DoxxScan trial today and combine its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage—including children’s gaming accounts—to reduce the long-term impact of breaches like this one.