VULNpocalypse
LowBreach / campaignMonitoring

Cloak ransomware group claims attack on ele****ar.de, according to RansomLook

The Cloak ransomware group lists the German domain ele****ar.de on its leak site per RansomLook, unconfirmed, so watch for an official notice.

Published
Exploitation
Not confirmed, the only evidence is a leak-site listing recorded by RansomLook

What happened

According to RansomLook, the Cloak ransomware group added an entry for the partly masked domain ele****ar.de to its leak site on 2026-11-06. RansomLook records these details for the listing:

  • Country: Germany
  • Claimed size: 410GB
  • Status: “Private”
  • Views: 0

This is a claim by the group. The details have not been confirmed:

  • The organisation behind the domain has not confirmed an incident in the sources.
  • No independent outlet has verified the claim.
  • The full name of the organisation is not confirmed.
  • What data, if any, was taken is not confirmed.
  • How the group got in is not confirmed.

RansomLook describes Cloak as a double-extortion ransomware group that first appeared publicly in mid-2023. RansomLook says the group reportedly gets into networks through initial access brokers, phishing, malvertising and exploit kits. These are general methods the group is reported to use. They are not confirmed as the method in this case.

Am I affected?

Not confirmed. Only the masked domain and the country (Germany) are published by RansomLook. The sources name no products, software versions or CVEs. This listing creates no known risk for developers in general.

What to do now

  1. If you are a customer, partner or employee of the organisation behind ele****ar.de, watch for an official statement or breach notification from it.
  2. Treat any unexpected message that refers to this incident with care, and check it through a contact channel you already know.
  3. Do not download or share material said to come from the leak site.

Sources