VULNpocalypse
LowBreach / campaignMonitoring

iah647 ransomware group claims attack on fhiworks, per RansomLook

RansomLook reports that the iah647 ransomware group lists fhiworks on its leak site; the claim is unconfirmed, so monitor for official statements.

Published
Exploitation
No confirmation. This is only a leak-site claim reported by RansomLook, with no independent verification.

What happened

According to RansomLook, the iah647 ransomware group claims fhiworks on its leak site. RansomLook’s headline is dated 2026-11-10 and reads “fhiworks: claimed by the iah647 ransomware group on its leak site” (RansomLook).

Only the headline could be retrieved. The full article could not be reviewed, so this advisory goes no further than what the headline says.

Not confirmed: whether fhiworks has acknowledged an incident, whether any systems were encrypted, whether any data was stolen, how access was gained, and how much data is involved. A leak-site listing is a claim by the group, not proof of a breach. No independent outlet carrying this story was found, only a claim tracker.

Am I affected?

Not confirmed. There is no statement from fhiworks in the sources, and no details on which data or systems might be involved. If you are a customer or partner of fhiworks, the only thing the source supports is that a ransomware group has listed the company.

What to do now

  1. Check the fhiworks website and official channels for any statement about an incident.
  2. If you work with fhiworks, ask your contact there directly whether they have confirmed an incident and whether your data is involved.
  3. Treat unexpected emails or calls that mention fhiworks or your data with caution, and verify through a known channel.
  4. Revisit this advisory if fhiworks or an independent outlet publishes more detail.

Sources