Gitlabs: Omydoo, Ayomi, ADULLACT Listed by fog Ransomware Group

On February 13, 2025, the fog ransomware group added three organizations — Omydoo, Ayomi, and ADULLACT — to its public leak site, claiming to have exfiltrated internal files from Gitlabs environments used by the companies.

What's Publicly Reported from Reporting

Public reporting indicates the victims were listed on the fog ransomware leak site hosted on the dark web. The group states it obtained internal data during a ransomware incident targeting Gitlabs infrastructure. No exact number of affected individuals has been disclosed, and the precise volume or sensitivity of the stolen files remains unconfirmed in available reporting. The listing appeared on February 13, 2025, following the group’s standard pattern of publishing victim names after an initial extortion window.

Internal files were the category of data described as exfiltrated. Because the victims are organizations that handle client projects, partner information, and employee records, the exposure potentially includes personal data belonging to ordinary people whose information passed through these Gitlabs instances.

Why This Matters for You and Your Family

When companies lose control of internal files, the information inside often contains names, email addresses, phone numbers, project details, and sometimes addresses linked to clients or employees. If your data was among the records handled by Omydoo, Ayomi, or ADULLACT, it can surface in follow-on attacks. Cybercriminals combine these details with other leaks to build profiles that lead to phishing, identity theft, or harassment aimed at you or members of your household.

February 13, 2025 marks the public disclosure date. Once data appears on a ransomware leak site, copies frequently spread to other criminal forums within days. The longer you wait to act, the more time threat actors have to weaponize what was taken.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently contain email addresses, usernames, and project notes that link online handles to real-world identities. Criminals follow these connections across social media, gaming platforms, and data-broker records. A single leaked work email can reveal your personal accounts, your children’s usernames, and household details. This creates an identity chain that turns one breach into repeated targeting through doxxing, account takeovers, and extortion attempts.

Credential leaks of this nature regularly cascade into gaming account compromises. Children’s profiles on popular platforms are especially vulnerable because the same passwords or recovery emails are often reused. Once attackers control a gaming account, they can harvest additional personal information and expand the chain further.

Fog Ransomware Group Track Record

Public reporting attributes the fog ransomware group with operations that emerged in 2024. The group has listed numerous organizations on its leak site, typically following a double-extortion model: it encrypts victim systems and threatens to publish stolen data unless a ransom is paid. Its playbook usually involves initial access through compromised credentials or vulnerabilities, followed by exfiltration of internal files before encryption. Notable prior victims include companies across various sectors, though exact details vary by incident. The group maintains a leak site to pressure victims publicly when negotiations fail.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can break the chains created by this leak.
• Rotate any password used at the affected Gitlabs instances anywhere it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours, not months.
• Cover the household with DoxxScan family protection that includes dependents and your children’s gaming accounts, which often chain back to the same leaked details.
• Let remediation specialists handle takedown requests for any exposed personal records that appear on data brokers or forums following this incident.

The fog ransomware incident is a reminder that data handled by companies you interact with can appear on leak sites without warning. Taking concrete steps now limits how far attackers can travel along the identity chains they build. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with coverage that extends to your entire family and children’s gaming accounts.