VULNpocalypse
LowBreach / campaignMonitoring

Vexy ransomware group claims JHAMF Group on its leak site, per RansomLook

RansomLook reports the Vexy ransomware group listed Colombian IT firm JHAMF Group on its leak site; customers should watch for an official notice.

Published
Exploitation
Not confirmed, the only evidence is a leak-site listing tracked by RansomLook, with no confirmation from JHAMF Group

What happened

According to the claim tracker RansomLook, the Vexy ransomware group added a post titled “JHAMF Group” to its leak site, dated 2026-10-31. The listing is the group’s claim, not proof of an attack.

The post’s description, as shown by RansomLook, calls JHAMF Group a Colombian IT services company. It lists the company’s work as IT infrastructure, telecommunications, software licensing and implementation, network installation and certification, technical support outsourcing, and cloud infrastructure solutions including Microsoft Azure.

The following details are not confirmed:

  • JHAMF Group has not confirmed any incident in the sources available.
  • No independent outlet has verified the claim.
  • What data, if any, was taken is not confirmed.
  • How the group would have gained access is not confirmed.
  • Whether any data has been published is not confirmed.

RansomLook’s page shows that the Vexy group has 28 posts in total. Several of them name other IT, hosting and managed service providers.

Am I affected?

Not confirmed. The sources do not say which systems, customers or data, if any, are involved. If you are a JHAMF Group customer or partner, the only established fact is that the company’s name appears on the Vexy leak-site listing tracked by RansomLook.

What to do now

  1. If you are a JHAMF Group customer, ask your account contact whether the company is investigating the claim and whether your environment is in scope.
  2. Watch for an official statement or notification from JHAMF Group before acting on the claim as fact.
  3. If JHAMF Group holds credentials or delegated access to your systems or cloud tenants, check with your own security team whether that access should be reviewed. This step is general caution and is not based on anything in the sources.

Sources