Chaos ransomware group lists horizonmedia.com on its leak site

• Ransomware group: Chaos
• Country: United States
• Sector: Technology
• Announcement date: February 9, 2026

The threat actor known as Chaos has claimed responsibility for a significant data breach targeting the United States-based organization Horizon Media. According to an announcement made on the group's leak site, the attackers claim to have compromised a massive volume of sensitive corporate information belonging to the media agency.

The details of the claim

The Chaos group officially announced its targeting of horizonmedia.com on February 9, 2026. According to the group's statement, the alleged incident occurred on February 19, 2025. The threat actor has issued a deadline, stating that if the organization does not meet its demands within 48 hours, the alleged stolen data will be released to the public.

This tactic is a hallmark of double-extortion ransomware strategies. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data beforehand. The threat of leaking this information serves as additional leverage to compel the victim to pay the ransom, even if they have robust backups to restore their systems.

The scope of the alleged data theft

The threat actor claims to be in possession of 3.2 TB of sensitive corporate data. While the volume of the data is substantial, the group has not provided any specific details regarding the specific file types or the exact nature of the contents contained within the stolen information. Furthermore, the listing does not provide information regarding the specific file count or the amount of the ransom demand.

The listing names no specific data types. Additionally, a screenshot provided by the group indicates that the leak page itself was currently inaccessible at the time of the announcement due to a technical error.

About Horizon Media

Horizon Media is a US-based independent media agency that provides media planning and buying services. The company develops strategic media investments and marketing solutions for brands.

Impact assessment and industry considerations

Public information regarding the Chaos group remains limited, making it difficult to establish a long-term pattern of behavior. However, the reported volume of 3.2 TB of data could create a significant negative impact on the organization's operational continuity and potentially damage client trust. Because the organization is based in the United States, a potential breach of this scale may lead to formal investigations under state-level data protection laws and oversight by various regulatory bodies.

If the data is indeed leaked, secondary risks may emerge, such as identity theft or targeted phishing attacks directed at the organization's employees and customers. In the technology and media sectors, such incidents often necessitate a multi-faceted response involving forensic investigation, legal consultation, and enhanced communication strategies to manage stakeholder expectations.

To defend against such threats, organizations typically implement layered security measures. This includes robust endpoint detection and response (EDR) systems, strict identity and access management (IAM) to enforce the principle of least privilege, and comprehensive data loss prevention (DLP) tools to monitor and block unauthorized exfiltration. Furthermore, maintaining offline, immutable backups is a critical component of a modern cyber resilience strategy to mitigate the impact of encryption-based attacks.