US Claims Solutions Listed by knight Ransomware Group

On November 1, 2023, US Claims Solutions appeared on the leak site operated by the knight Ransomware Group. The listing states that the company, along with related entities Mankin Custom Motors, LLC and The FF&O Group, suffered a ransomware attack in which attackers exfiltrated more than 600GB of internal files. Anyone whose insurance claims, employment records, or personal information passed through these businesses is now at risk.

Details from the Leak-Site Listing

The knight leak site posting states that attackers stole data from US Claims Solutions and its affiliated companies, including Mankin Custom Motors and The FF&O Group. The disclosure indicates that over 600GB of sensitive data were taken during the ransomware incident. The listing does not specify the exact types of records or the total number of individuals affected, stating only that internal files were exfiltrated. A contact email for “Doug IT” (doug@squaremoat.com) appears alongside screenshots and a partial data sample, with the attackers noting they “don’t like players.” The primary source provides no further quantification of impacted records or systems.

Why This Matters for You and Your Family

When a company that handles insurance claims or vehicle-related services is breached, the information stolen often includes names, addresses, dates of birth, Social Security numbers, driver’s license details, and financial records tied to claims. Even though the exact data types are not detailed in the listing, the volume—more than 600GB—suggests a significant amount of personal information is now in criminal hands. For ordinary families, this can translate into heightened risk of identity theft, fraudulent loan applications, tax fraud, or medical-identity misuse. If you or a family member filed a claim through US Claims Solutions, Mankin Custom Motors, or The FF&O Group, your information may already be circulating among threat actors.

The Doxxing and Identity-Chain Risks

Exfiltrated internal files frequently contain spreadsheets that link customer identities to email addresses, phone numbers, policy numbers, and sometimes employer or vehicle details. These fragments become building blocks for doxxing chains: attackers combine them with data from other breaches to map out a person’s full digital footprint. A single leaked insurance record can expose not only your home address but also associated family members, children’s names, and even gaming usernames if they appear in correspondence or linked accounts. Once these connections surface on dark-web markets, the risk of targeted harassment, SIM-swapping, or account takeovers grows rapidly. Credential leaks of this nature routinely cascade into gaming account compromises for both adults and children, exposing chat logs, purchase history, and linked payment methods.

Knight Ransomware Group’s Known Track Record

Public reporting attributes the knight Ransomware Group’s emergence to mid-2023. The group has targeted organizations across multiple sectors, typically gaining initial access through phishing or exploited remote desktop protocols before deploying ransomware. After exfiltration, knight follows a double-extortion playbook: they threaten to publish stolen data unless a ransom is paid, then list non-paying victims on their leak site with samples to increase pressure. Prior victims have included businesses of varying sizes, with the group consistently emphasizing the volume of data taken and providing partial leaks as proof. While exact tactics can evolve, public reporting on knight indicates a focus on small-to-medium organizations that handle sensitive customer or operational files.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used at US Claims Solutions, Mankin Custom Motors, or The FF&O Group and enable 2FA with an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught within hours rather than months.
• Cover your entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same leaked addresses or emails.
• Let remediation specialists handle data-broker takedown requests and opt-out processes for you instead of attempting manual removal across dozens of sites.

The knight listing is a clear reminder that even mid-sized service providers can become gateways to widespread personal exposure. Taking concrete steps now limits how far attackers can travel down the identity chain created by this 600GB theft. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks that follow incidents like this one.