Clop ransomware group lists DAD.CO.TH on leak site alleging data breach

• Ransomware group: Clop
• Country: Thailand
• Sector: Technology
• Announcement date: February 14, 2026

The Clop ransomware group has officially listed the Thailand-based organization DAD.CO.TH on its dedicated leak site. This listing includes an allegation of a data breach against the technology sector firm, marking a new potential victim for the threat actor group.

The details of the claim

According to the announcement published on the group's platform, the inclusion of DAD.CO.TH was added on February 14, 2026. In the announcement, the Clop group shared a warning message directed at the institution. Within this message, the group alleges that the organization has neglected its responsibility regarding customer security. This claim suggests that the group is utilizing a double extortion tactic, where they not only encrypt systems but also threaten to release sensitive information to pressure the victim into paying a ransom.

Double extortion is a common methodology used by modern ransomware groups. In these scenarios, attackers aim to maximize their leverage by threatening to leak stolen data on public or semi-public leak sites if their demands are not met. This tactic increases the pressure on organizations, as the threat of data exposure can lead to significant reputational damage and regulatory scrutiny, even if the organization has robust backup and recovery capabilities.

Information regarding the alleged leaked data

Despite the public listing on the leak site, the group has not provided specific details regarding the content of the alleged leaked data. Furthermore, no sample files have been released to substantiate the claim of a successful breach. The listing currently provides no information regarding the total size of the data or the specific number of files involved in the incident.

• No specific data types were named in the listing.

When ransomware groups operate, the absence of immediate data samples can sometimes be a precursor to a larger leak, or it may indicate that the group is still in the early stages of their extortion process. Organizations facing such threats typically monitor these leak sites closely to determine the scope of the potential exposure.

Analysis and potential implications

The Clop group is well-known in the cybersecurity landscape for conducting large-scale data theft campaigns. Historically, this group has frequently exploited vulnerabilities in file transfer software to gain access to corporate networks and exfiltrate sensitive information. Given this established pattern of activity, the listing of DAD.CO.TH may be an indication that a technical vulnerability was exploited to facilitate a data breach within the institution's systems.

The potential exposure of customer data carries significant secondary risks. If a breach is confirmed, the leaked information could be utilized by malicious actors for identity theft or targeted phishing attacks against the organization's clients. Furthermore, because DAD.CO.TH is based in Thailand, a confirmed data breach could trigger complex legal processes under local data protection regulations. Organizations operating in the technology sector must remain vigilant to ensure compliance with these regional mandates to mitigate legal and financial liabilities.

Defensive measures for technology organizations

To defend against the tactics employed by groups like Clop, organizations in the technology sector should prioritize robust security frameworks. This includes maintaining rigorous patch management protocols to address vulnerabilities in file transfer software and other internet-facing assets. Implementing strong access controls and multi-factor authentication can also reduce the likelihood of unauthorized access.

Additionally, organizations should focus on data loss prevention (DLP) strategies and continuous monitoring of network traffic to detect unusual patterns that might indicate exfiltration. Developing a comprehensive incident response plan that includes legal and communication strategies is essential for managing the fallout of a potential data breach and ensuring a coordinated response to regulatory requirements.