International Busines Service Listed by crypto24 Ransomware Group

On April 8, 2025, the ransomware group known as crypto24 added International Business Service to its leak site and began publishing internal files stolen from the company, including scanned identity cards (front and back) belonging to approximately 3,000 people.

Reported Details of the Breach

Public reporting indicates the attackers exfiltrated a range of sensitive documents during a ransomware incident. The exposed materials include images and PDFs of national identity cards for roughly 3,000 individuals, along with HR reports and payroll documents. The data appeared on the crypto24 leak site hosted via ransomware.live, where the group lists victims who have not met their demands.

At the time of publication, the exact number of affected employees, contractors, or clients remains unclear beyond the 3,000 identity documents. No evidence has surfaced that customer databases or financial account numbers were included in the initial dump, but the presence of identity cards and payroll files creates immediate risks for everyone whose personal information was stored by the company.

Why This Matters for You and Your Family

When a company that handles employment records suffers a breach, the people whose identity cards, addresses, and salary details are exposed are ordinary workers and their families. Identity cards contain your photograph, full name, date of birth, national ID number, and address — exactly the information needed to open accounts, apply for credit, or impersonate you. Payroll files often list spouses, dependents, and banking details that can be combined with the identity documents to build a complete profile.

HR reports and pay documents can reveal where you work, how much you earn, and personal notes that scammers use to sound legitimate when they contact you or your relatives. Once this information is public, it does not disappear. Copies spread quickly across forums and dark-web markets, increasing the chance that someone will target you or a member of your family months or even years later.

The Doxxing and Identity-Chain Risks

Identity cards and payroll records rarely exist in isolation. A scanned ID often links your real name and address to email accounts, phone numbers, or usernames used for work. Attackers can use these connections to locate your social-media profiles, gaming accounts, or family members’ information. This process, known as identity-chain mapping, turns one leak into a cascade of exposures.

Credential leaks like this one cascade into account takeovers and doxxing chains. If you reuse even a single password from a work account, or if your children use family-linked emails for gaming, the stolen data can lead to compromised logins on Steam, Roblox, Discord, or other platforms. Public reporting shows these chains frequently result in harassment, SIM-swapping attempts, or demands for payment to prevent further release of private files.

Crypto24’s Publicly Known Track Record

Public reporting attributes the crypto24 ransomware group with emerging in late 2024. The group has listed a growing number of victims on its leak site, focusing primarily on small-to-medium businesses. Its typical playbook involves gaining initial access through phishing or exploited remote-desktop services, exfiltrating files before deploying ransomware, and then pressuring victims with threats to publish stolen data if ransom is not paid.

The group’s extortion style relies on public shaming via leak sites rather than sophisticated negotiation. Available reporting describes crypto24 as relatively new compared with established ransomware operations, yet it has already demonstrated willingness to publish sensitive employee records when companies refuse to pay. Exact success rates and prior notable victims remain limited in open sources, but the pattern of targeting HR and identity documentation appears consistent.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity drawn from the 13.1 billion+ breach records now circulating across more than 100 platforms.
• Rotate any password you ever used at International Business Service and enable two-factor authentication through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring so the next breach exposing your family is detected and addressed within hours rather than months.
• Cover the household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails now exposed in this incident.
• Let remediation specialists handle takedown requests for your personal documents across data brokers and leak repositories while you focus on securing your own accounts.

The most important step is acting before criminals combine this new data with information already available about you online. Start your DoxxScan trial today and let its continuous monitoring across 13.1B+ breach records, AI-powered identity-chain mapping, and hands-on remediation specialists protect your family — including gaming accounts that can quickly become targets once personal details surface. DoxxScan by GalaxyWarden is built precisely for incidents like this one.