1X Internet targeted by fog ransomware group in alleged data breach

• Ransomware group: fog
• Country: Germany
• Sector: Technology
• Announcement date: March 6, 2025

The threat group known as fog has published an announcement on its leak site, claiming to have leaked 39 GB of data belonging to 1X Internet. This announcement, which appeared on March 6, 2025, suggests a significant breach of the organization's digital assets.

The claimed attack and event details

According to the announcement posted by the fog group, the breach is claimed to have occurred on March 5, 2025. The group has asserted that they successfully compromised the infrastructure of 1X Internet and subsequently exfiltrated a substantial volume of information. In their public post, the group listed the data belonging to 1X Internet alongside other organizations in a collective announcement, a common tactic used by ransomware groups to demonstrate their reach and pressure victims.

Ransomware leak sites function as a platform for cybercriminals to host stolen data, often as part of a double extortion scheme. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to threaten its public release. This method increases the pressure on the victim to pay a ransom to prevent the exposure of proprietary or regulated data.

Data involved in the alleged leak

The fog group's claim specifies that the stolen information was allegedly obtained from the organization's GitLab infrastructure. The volume of the data involved is reported to be 39 GB. The specific contents of this data are tied to the development environment of the company, which poses unique risks to their technical operations. The listing identifies the following affected data types:

• GitLab source code

The exposure of source code is a critical security concern for technology firms. When code is leaked, it can reveal the inner workings of software applications, potentially exposing vulnerabilities that can be exploited by other malicious actors. This can lead to secondary attacks or the development of supply chain vulnerabilities, where the integrity of the software provided to clients is called into question.

About 1X Internet

1X Internet is a digital agency and software development company based in Berlin, Germany. The organization specializes in providing a variety of digital services, including Drupal-based web solutions, the creation of corporate websites, and various digital transformation projects. Given their focus on software development and digital solutions, the integrity of their development infrastructure is central to their business model.

Analysis and potential implications

This leak claim may pose significant risks to the organization's intellectual property and its overall software development processes. Because the data was allegedly obtained from a GitLab infrastructure, there is a high probability that the organization's source code and sensitive development information have been exposed. Such a breach can compromise the proprietary logic and unique configurations that define their digital products.

Furthermore, because 1X Internet is based in Germany, this incident may trigger mandatory data breach notification obligations under the General Data Protection Regulation (GDPR). Regulatory frameworks like GDPR require organizations to report significant data breaches to authorities to ensure transparency and protect the rights of individuals whose data may have been compromised.

For organizations operating in the technology and software development sector, such incidents highlight the importance of robust security measures for development environments. Defensive strategies often include implementing strict access controls, utilizing multi-factor authentication for all infrastructure components, and maintaining continuous monitoring of version control systems like GitLab. Additionally, organizations should consider the potential for secondary attacks stemming from leaked code and should have incident response plans ready to address both technical remediation and regulatory compliance requirements.

At this time, information regarding the fog group remains limited, and the claims made by the group have not been independently verified.