Ramsey Bros Data Breach

On August 18, 2026, Ramsey Bros, an operator in the commercial and industrial services sector based in Australia, was listed on the dark web portal of the Storm ransomware group. This listing was identified via SOCRadar’s Dark Web Monitoring service. The company operates under the domain ramseybros[.]com[.]au. The nature of Ramsey Bros’ operations and its presence in Australia may have made it an attractive target for ransomware actors, especially given the recent trend of attacks on Australian organizations. In the 60 days preceding this listing, Storm claimed 24 other victims. Australia has emerged as a frequent target geography for Storm, alongside the United States and Canada. Notably, other recent Australian victims of Storm include 3-point Australia and TRP International. On the same day as the Ramsey Bros listing, Storm also listed Westco Motors Cairns and Penfold, further emphasizing a pattern of targeting Australian entities. This consistent clustering of victims across various Australian sectors suggests a regional focus in Storm’s current operations, rather than a strict adherence to specific industry targeting.

A query of stealer-log data for the domain ramseybros[.]com[.]au revealed a single record: a corporate email credential (pau****k@ramseybros[.]com[.]au). This credential was harvested from the MyHeritage genealogy platform on February 22, 2026. The presence of a corporate email address on a consumer platform often indicates a workstation compromise, as stealer malware typically harvests all browser-stored credentials from an infected endpoint, irrespective of the website’s nature. However, this particular query did not find any corporate authentication infrastructure, such as Microsoft 365 or VPN credentials, within the analyzed data slice. It is plausible that the same endpoint from which the MyHeritage credentials were stolen also captured corporate system credentials that may be present elsewhere in the broader stealer-log dataset. To gain a more comprehensive understanding, it is recommended to expand stealer-log queries to encompass the identified corporate account across all recorded platforms and dates. Furthermore, an audit of corporate access logs dating back to February 2026 would be prudent to identify any anomalous activity. The absence of specific authentication infrastructure in the initial query does not rule out a potential compromise. Organizations should consider continued dark web and stealer-log monitoring, proactive credential hygiene checks, password rotation, and multi-factor authentication reviews for all accounts. Monitoring of alternate corporate domains and a thorough review of Microsoft 365, VPN, and remote-access activity are also recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.