Exset Listed by malas Ransomware Group

On April 9, 2023, the ransomware group known as Malas added Exset to its public leak site, claiming that the company’s internal files had been exfiltrated following a ransomware attack that exploited a Zimbra vulnerability. The listing does not specify how many people are affected or exactly which records were taken, leaving current and former customers, employees, and anyone whose information passed through Exset in the dark about the full scope of their exposure.

Reported Details from the Listing

The Malas leak site states that Exset suffered a ransomware incident in which attackers used a known vulnerability in the Zimbra collaboration suite to gain initial access. Internal files were allegedly exfiltrated before encryption took place. The disclosure does not quantify the volume of data, list specific record types, or provide a ransom demand deadline. It simply marks Exset as a “defaulter,” the group’s term for victims who have not paid. Public reporting on similar Malas listings indicates that samples of the stolen material are often published to pressure negotiation, though the primary source for this incident does not detail what, if anything, has been released so far.

Why This Matters for You and Your Family

When a company that handles customer records, employee payroll, vendor contracts, or partner communications is breached, your personal information can end up in the hands of criminals even if you never directly signed up with them. Internal files exfiltrated in a ransomware attack frequently contain spreadsheets of names, addresses, dates of birth, Social Security numbers, email accounts, and financial details. Once that material leaves the victim’s network, it circulates among initial access brokers and extortion crews. For ordinary people, this translates into heightened risk of identity theft, loan fraud, and unexpected tax filings in your name. Because the leak site does not disclose the exact data types or number of records, you must assume that any interaction you or your family had with Exset could now be exposed.

Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at posting a single company name. They understand that stolen internal files create long identity chains. An employee’s work email found in one spreadsheet can be matched to personal accounts, family addresses, and children’s usernames. Those links allow attackers to move from corporate data to individual doxxing. A phone number tied to an Exset vendor record, for example, can be cross-referenced with gaming accounts or social-media handles. The result is a map that reaches far beyond the original breach. Credential leaks of this nature frequently cascade into account takeovers on personal services, including gaming platforms used by children. Once a single handle is compromised, the entire household profile becomes easier to build and sell.

Malas Ransomware Group Track Record

Public reporting attributes the emergence of Malas to late 2022. The group has targeted organizations across multiple sectors, typically gaining entry through unpatched vulnerabilities in email and collaboration platforms such as Zimbra. After exfiltrating files, Malas follows a double-extortion playbook: it threatens both to encrypt remaining systems and to publish sensitive data on its onion site. Notable prior victims listed on ransomware trackers include mid-sized businesses whose internal documents appeared after similar Zimbra exploits. The group’s leak site updates are often timed to coincide with negotiation windows, and samples are released incrementally when payments are refused. While exact success rates remain unknown, the consistent pattern shows that Malas prioritizes speed of initial access and steady pressure through public shaming.

What to do

• Rotate any password you ever used at Exset or any related service, and enable 2FA through an authenticator app rather than SMS.
• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points in doxxing chains after credential leaks like this one.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal records found circulating on data-broker and extortion sites.

The Exset breach is a reminder that even organizations you interact with indirectly can become gateways to your family’s personal information. Staying ahead requires more than checking a single list; it demands ongoing visibility into how your identity surfaces across the internet. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists who also safeguard household and children’s gaming accounts that frequently chain back to the same leaked credentials.