Garnica Plywood Listed by Avoslocker Ransomware Group

On December 26, 2022, Spanish wood-products manufacturer Garnica Plywood appeared on the leak site operated by the AvosLocker ransomware group. The listing states that internal files were exfiltrated during a ransomware attack and warns that all data will be leaked on September 1 unless the company meets the extortion demand. A sample posted alongside the notice includes contact information and references to the company’s plywood manufacturing processes.

Primary Disclosure Details

The AvosLocker leak site entry, preserved via ransomware.live, states that Garnica suffered a ransomware intrusion in which attackers successfully exfiltrated internal files. The disclosure does not quantify the number of records affected, nor does it list specific data types beyond “internal files.” It does state that a sample has been published and sets an explicit public-release deadline of September 1. No formal breach notification from Garnica itself has surfaced, so all What's Publicly Reported originate from the threat actor’s own publication channel.

Why This Matters for You and Your Family

When a manufacturer’s internal files are stolen and threatened with release, anyone whose personal information appears inside those files faces immediate risk. Contact details, employee records, customer invoices, or vendor contracts can contain names, addresses, phone numbers, and email accounts. Once published on a ransomware leak site, that information is indexed by search engines, scraped by data brokers, and circulated on underground forums. For ordinary people, this means your data could be used for identity theft, phishing campaigns, or sold to other criminals who target you or your family members.

Internal files from a company like Garnica often include spreadsheets that link business contacts to home addresses or personal mobile numbers. Even if you never directly purchased plywood, you or a family member could have been listed as a supplier, contractor, or employee. The exposure therefore extends beyond the company’s walls into the households connected to its operations.

Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at one dataset. A single leaked email or phone number becomes the starting point for an identity chain that links gaming handles, social-media accounts, family-member profiles, and financial records. Attackers or subsequent buyers can pivot from the Garnica files to compromise accounts that reuse the same credentials. Children’s gaming accounts are especially vulnerable because parents frequently reuse passwords or security questions derived from work or personal documents. The result is a cascading doxxing risk that can expose your full digital life months after the initial breach.

AvosLocker’s Known Track Record

Public reporting attributes the emergence of AvosLocker to mid-2021. The group has targeted organizations across manufacturing, healthcare, and professional services, often listing victims on its dedicated leak site when ransom is not paid. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by deployment of ransomware that both encrypts systems and exfiltrates data. The extortion style is double-layered: demand payment to prevent encryption recovery and further threaten to publish stolen files on the public leak portal. While exact success rates remain uncertain, the group’s persistent leak-site activity shows they follow through on publication deadlines when victims do not negotiate.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you used at Garnica or any related vendor account anywhere it has been reused, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same addresses and credentials.
• Let remediation specialists manage takedown requests for any exposed personal records appearing on data-broker or underground sites.

The Garnica Plywood listing is a reminder that ransomware incidents continue to place ordinary families in the crosshairs long after the initial attack. Acting quickly on credential hygiene and identity mapping can limit how far the breach travels. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly includes children’s gaming accounts at risk of takeover from credential leaks like this one.