Who Is MONTY? ;) Listed by Donutleaks Ransomware Group

On September 1, 2023, the ransomware group MONTI listed donutleaks on its leak site, claiming the operator owes them 100,000 USD and posting what it described as login details for the site’s admin panel. The primary disclosure on the MONTI leak portal indicates that internal files were exfiltrated during a ransomware attack on the donutleaks operation itself.

Reported Details from the Listing

The MONTI leak-site entry states that internal files were taken in the ransomware incident. It does not quantify how many records were affected, nor does it list specific data types beyond the general description of internal files. The posting also includes what MONTI alleges are valid administrator credentials for donutleaks, though the exact scope of access those credentials provide remains unconfirmed by the primary source. Public reporting on the incident, drawn directly from the onion link, shows the demand for 100K USD and the taunting title “Who Is MONTY? ;)” as the group’s opening move in its extortion sequence.

Why This Matters for You and Your Family

When a data-leak site itself is breached, the exposure can ripple outward quickly. Anyone whose information was ever stored on or submitted through donutleaks now faces heightened risk because the attackers have both the internal files and, apparently, administrative access. Internal files exfiltrated in ransomware attacks frequently contain contact details, account credentials, or logs that tie real identities to online activity. For ordinary people, this means your email address, username, or password reused from another service could surface in follow-on leaks or be sold quietly on underground forums.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at one dataset. Once MONTI obtained administrative login details and internal files, the group gains the ability to map relationships between accounts, email addresses, and real-world identities. These identity chains often begin with a single breached credential and expand to gaming accounts, family email addresses, and linked phone numbers. The result is doxxing that can expose your home address, family members’ names, and even children’s online profiles. Credential leaks like this one routinely cascade into account takeovers across unrelated services, turning one ransomware incident into months of identity-related harassment.

MONTI’s Publicly Known Track Record

Public reporting attributes MONTI’s emergence to mid-2022, positioning the group as a successor or rebrand of earlier operations. The gang has targeted a range of organizations, often focusing on smaller or lesser-known entities where defensive visibility is low. Their typical playbook begins with initial access through phishing or exploited remote desktop services, followed by claimed exfiltration of internal files before encryption. Extortion then proceeds in two stages: first a ransom demand for decryption and non-disclosure, then public shaming on the leak site if payment is not made. The donutleaks listing follows this exact pattern, with the added twist of directly naming and mocking the victim in the post title.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, using cleanup handled by the specialists.
• Rotate any password you ever used on donutleaks or similar leak-related services, and enable 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which frequently become targets when credential leaks create doxxing chains.
• Let the remediation specialists perform hands-on takedown requests across data brokers and underground sites on your behalf.

The MONTI listing of donutleaks on September 1, 2023, is a reminder that even operators in the underground economy can become victims, instantly exposing anyone whose data touched the service. One short forward-looking step can limit the damage: start your DoxxScan trial today. Its continuous monitoring across 13.1 billion-plus breach records and 100-plus platforms, combined with AI-powered identity-chain mapping and hands-on remediation by specialists, gives your entire household—including children’s gaming accounts—practical protection against the next wave of leaks. Source: MONTI Leak Site via ransomware.live