inwi.ma Listed by Stormous Ransomware Group

On December 21, 2023, Moroccan telecommunications provider inwi.ma appeared on the leak site operated by the Stormous ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the company, which was founded in 1999 and provides voice, internet, and data services to both private customers and corporate clients across multiple countries. The number of people whose information is contained in the stolen files remains unknown, and the exact contents have not been detailed beyond the generic description of internal files.

Details in the Leak-Site Listing

The Stormous leak page explicitly lists inwi.ma as a victim and claims the company suffered a ransomware intrusion that resulted in data exfiltration. No sample files have been published at the time of the disclosure, and the listing does not quantify how many records were taken or name specific categories such as customer billing records, contracts, or employee payroll data. The notification simply confirms that internal files were removed from inwi’s systems. Public reporting on Stormous indicates the group typically posts victim names and sometimes partial data samples after the victim declines to pay the demanded ransom.

Why This Matters for You and Your Family

If you or any member of your household has been an inwi customer, your personal details may now sit in an attacker-controlled archive. Telecommunications providers routinely hold names, addresses, national identification numbers, phone numbers, billing information, and in some cases payment card data. Even without an exact record count, the exposure creates immediate risks: attackers can use this information for identity theft, targeted phishing calls that appear to come from your own provider, or sell the dataset on underground forums. Your family’s daily reliance on mobile and internet service means the breach touches nearly every digital interaction you have.

Doxxing and Identity-Chain Risks

Telecom breaches rarely stop at one dataset. A single exposed phone number or email address frequently links to your social-media handles, gaming accounts, and other online profiles. Attackers chain these together to build a complete picture of your life—home address, family members’ names, and financial relationships. This is exactly how doxxing campaigns begin: one credential leak leads to account takeovers that expose even more personal data. Credential leaks like this one cascade into account takeovers that can affect both adult and children’s gaming accounts tied to the same household address or parent email.

Stormous Group Track Record

Public reporting attributes the first significant activity by Stormous to early 2022. The group has since claimed responsibility for attacks on organizations in healthcare, education, government, and critical infrastructure sectors. Notable prior victims include municipalities, universities, and other telecommunications firms. Their typical playbook involves gaining initial access through phishing or exploited remote-desktop services, exfiltrating data before deploying ransomware, then publishing victim names on their leak site when the ransom is not paid. Stormous often uses double-extortion tactics—threatening both data encryption and public release—though the precise ransom amount demanded from inwi has not been disclosed.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used for inwi.ma or related services anywhere it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts that could chain back to the same breached data.
• Let remediation specialists manage takedown requests for any exposed personal records that appear on data-broker or underground sites.

The inwi.ma breach is a reminder that even established telecommunications operators remain targets, and the data they hold can fuel long-term identity abuse if left unchecked. One short forward-looking step is to treat every provider breach as a signal to lock down the chains that connect your digital life. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts.