RansomLook reports audit team group claims roycegroup on leak site

What happened

According to the tracker RansomLook, a ransomware group named “audit team” claims roycegroup on its leak site. RansomLook dated its entry 2026-11-09 and titled it “AUDIT ENTITY: roycegroup: claimed by the audit team ransomware group on its leak site” (RansomLook).

A leak-site listing is the group’s own claim, not proof of an attack. The full article could not be reviewed, only the headline. This advisory therefore rests on that headline alone.

Not confirmed:

• Whether roycegroup has acknowledged any incident.
• Whether any systems were encrypted or any data was stolen.
• The entry point, the data volume and the date of any intrusion.
• Whether any independent outlet has verified the claim.

Am I affected?

Not confirmed. The headline names roycegroup as the claimed target and gives no detail about customers, partners or data. No CVE, product or software vulnerability is named in the source. If you have no relationship with roycegroup, nothing in the source suggests you are affected.

What to do now

1. Check for an official statement from roycegroup before acting on the claim. None was found in the source.
2. If you work with roycegroup, ask your contact there whether they are aware of the claim and whether your data or access is involved.
3. Follow your normal vendor-risk process for a possible third-party incident, and wait for confirmed details before taking drastic steps.
4. Revisit this advisory when more reporting appears. It will be updated if the claim is confirmed or denied.

Sources

• RansomLook: AUDIT ENTITY: roycegroup: claimed by the audit team ransomware group on its leak site