Gomomentum.com targeted by EndZone ransomware group

• Ransomware group: EndZone
• Country: United States
• Announcement date: September 21, 2026

EndZone claims breach of Gomomentum.com

The ransomware group known as EndZone has listed the telecommunications company Gomomentum.com on its leak site. According to the group's announcement, they have successfully gained access to the organization's systems, leading to a significant data leak involving a massive number of users.

The claim, announced on September 21, 2026, suggests a targeted operation aimed at compromising the integrity of the company's digital infrastructure and the privacy of its customer base. While the group has made these claims publicly, no screenshots or additional evidence were provided in the initial announcement to verify the contents of the breach.

Details of the alleged attack and service disruption

According to the claims made by EndZone, the attackers gained entry to Gomomentum.com's environment by exploiting a diagnostic and provisioning tool. This access was reportedly facilitated through a third-party operator, highlighting the risks associated with supply chain vulnerabilities and third-party integrations in complex network environments.

The group alleges that they exploited critical vulnerabilities within this specific system to facilitate their intrusion. Beyond the theft of information, the group claims to have caused direct operational damage. Specifically, it is stated that the modem configurations for 58,127 users were deleted. This action reportedly resulted in significant service disruptions for those affected customers, impacting the organization's ability to provide continuous connectivity.

Data involved in the incident

The announcement claims that a massive amount of sensitive information has been compromised. The group alleges that the following data type has been accessed:

• Personally identifiable information (PII)

The group claims that the amount of compromised personally identifiable information (PII) exceeds 7.5 million users. No specific file counts or total data sizes were provided in the leak site post.

About Gomomentum.com

Momentum is a telecommunications company that provides cloud-based communication solutions for businesses. The company specializes in cloud voice services, managed networks, SD-WAN solutions, and Microsoft Teams integration.

Analysis and industry implications

This incident highlights a potential large-scale data breach within the telecommunications sector. The scale of the alleged theft, involving millions of users, suggests that such attacks can pose significant secondary risks to the public. When personally identifiable information (PII) is compromised, users often face increased risks of identity theft and become targets for highly specific, targeted phishing attacks.

Because the organization is based in the United States, the incident may trigger various legal and regulatory obligations. The company may be subject to various state laws and federal regulations regarding data privacy and the mandatory notification of breaches to affected parties. Furthermore, the reported deletion of modem configurations poses a threat to operational continuity and can severely damage customer trust in the service provider.

Regarding the threat actor, public information about the EndZone group remains limited. However, the nature of this operation—combining data theft with service disruption—suggests the group may be employing double-extortion tactics. In such scenarios, attackers not only steal data to threaten its release but also disrupt services to increase pressure on the victim to pay the ransom.

For organizations operating in the telecommunications and cloud services sectors, this event underscores the necessity of robust third-party risk management. Securing diagnostic and provisioning tools is critical, as these administrative interfaces often hold high-level privileges. Organizations can mitigate such risks by implementing strict access controls, continuous monitoring of third-party connections, and maintaining regular, offline backups of critical configurations to ensure rapid recovery in the event of a service-disrupting attack.