ESET appeared on the donutleaks ransomware extortion site on July 21, 2024, with the listing titled “KickDown ESET company. No overpayments at 0% (renamed and update).” The entry claims the antivirus maker suffered a ransomware attack in which internal files were exfiltrated. The donutleaks group states it penetrated a new version of ESET’s Premium Home Security Edition before any pentest occurred, and the post includes mocking commentary aimed at security journalists. The leak-site listing does not quantify how many records were taken or name specific data types beyond “internal files.”
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Eset
Get alerted the next time Eset files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Eset’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Primary Disclosure Details
The donutleaks page hosted on a Tor onion address states that ESET was compromised via ransomware and that attackers successfully exfiltrated internal files. It does not list a ransom amount, a negotiation timeline, or a sample of the stolen data. The note has been renamed and updated at least once since first publication, according to the site itself. Public reporting on the incident relies entirely on this primary leak-site posting; ESET has not yet issued a public breach notification that details the scope or states the claims.
Why This Matters for You and Your Family
When a major security-software vendor is hit, the ripple effects reach ordinary users who rely on that vendor’s products to protect their home computers, family photos, financial documents, and children’s devices. Even if the stolen material consists only of internal files today, tomorrow those files could contain support-ticket details, license keys, or partner contact lists that attackers later weaponize. July 21, 2024 marks the public confirmation that another household name in cybersecurity has been breached, underscoring that no company is immune and that your personal data may already sit inside one of the thousands of organizations that have suffered similar intrusions.
Doxxing and Identity-Chain Risks
Ransomware groups rarely stop at encryption. Once internal files leave the victim’s network they frequently surface on dark-web forums or are used to seed follow-on campaigns. A single email address or support ticket pulled from an antivirus company’s systems can link your gaming username, your child’s Roblox account, your phone number, and your home address into a single identity chain. That chain lets attackers pursue credential-stuffing attacks, SIM-swapping, or targeted extortion. Credential leaks like this one routinely cascade into account takeovers precisely because the same password or recovery details appear across consumer services and corporate support portals.