One Plus Capital Listed by Global Secret Group Ransomware Group

On July 26, 2026, Cyprus-based financial firm One Plus Capital was publicly listed on the leak site of the ransomware operation known as Global Secret Group. The extortion group claims to have exfiltrated 117 GB of internal files containing 285,919 files and 32,404 folders from the company, which employs 11-50 people and reports roughly $7 million in revenue. The disclosure does not specify the exact number of individuals affected or list the precise data types contained in the stolen material.

Reported Details from the Listing

The primary disclosure on the Global Secret Group leak site states that One Plus Capital suffered a ransomware attack in which internal files were successfully exfiltrated. The listing includes the company’s website (onepluscapital.net), its location in Cyprus, employee range, and exact volume of data: 117 GB across 285,919 files and 32,404 folders. No sample files have been published at the time of the listing, and the notification does not quantify how many customer records, employee records, or financial documents were taken. The group has not publicly stated a ransom demand or payment deadline in the visible listing.

Why This Matters for You and Your Family

When a financial services company like One Plus Capital is breached, the information stolen often includes personal details that can be used to target customers, investors, or employees. Even though the exact contents remain undisclosed, finance-sector ransomware incidents routinely expose names, addresses, dates of birth, tax identifiers, account numbers, transaction records, and correspondence. Any of these details in the hands of criminals can lead to identity theft, loan fraud, or targeted phishing campaigns against you or members of your household who may have done business with the firm.

The Doxxing and Identity-Chain Risk

Stolen internal files frequently contain spreadsheets that link customer identities to email addresses, phone numbers, payment details, and sometimes employee notes. These connections allow attackers to build detailed profiles that follow people across services. A credential or personal record exposed here can be combined with previous breaches to take over email accounts, banking portals, or investment platforms. The risk is especially acute for families because children’s names and dates of birth are often included in family-account documentation, creating long-term exposure that can surface years later in doxxing or social-engineering attacks.

Global Secret Group’s Known Track Record

Public reporting attributes Global Secret Group as a ransomware-as-a-service operation that emerged in late 2024. The group has targeted organizations across finance, healthcare, and professional services, typically gaining initial access through phishing, compromised remote desktop credentials, or exploited vulnerabilities in externally facing systems. After exfiltration, they follow a double-extortion model: threatening to publish the data unless ransom is paid, then listing victims on their dark-web portal when negotiations fail or deadlines pass. Their leak site is operated as part of a broader affiliate program, meaning the actual intrusion may have been carried out by a partner ransomware operator using Global Secret Group’s branding and infrastructure.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, usernames, and real-world identity so you can see exactly where your information surfaces from this and prior incidents.
• Rotate any passwords you have reused at One Plus Capital or similar financial sites and immediately enable 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next time your data appears it is caught within hours instead of months.
• Cover your entire household — DoxxScan family protection extends to dependents and children’s gaming accounts that often chain back to the same addresses and parent emails used in financial records.
• Let remediation specialists handle data-broker takedown requests and removal of exposed personal documents on your behalf instead of attempting manual cleanup.

The incident underscores that even small financial firms can become gateways to personal exposure for thousands of families. Staying ahead requires more than reactive password changes. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and over 100 platforms, AI-powered identity-chain mapping that connects disparate handles to real identities, and hands-on remediation specialists who manage takedowns for you and your entire household, including children’s gaming accounts vulnerable to credential-stuffing cascades. Acting now limits how far this breach can reach.